The parent comment raises a very good point. Does the supposed VK.com CJ vector work at all with Javascript disabled? Disabling JS stops the framebreaker; does the site UI still work when you do that?
yes it does. VK migrates "gracefully" and Like/friend/comment buttons work w/o JS.
I'm sure you know that most of the Rails forms will work w/o JS as well.
A protocol fix that meant that the server serving the content needed to opt in to no-script through a new X-Frame-Options header would mean that legacy content like vk.com wouldn't send a X-Frame-Options header, and so wouldn't be able to be framed in a no-script iframe.
and nobody will use it. because in fact NOBODY wants to run their pages w/o JS. And this is why sandbox is a bad idea.
Why is the answer not “HTML5 sandbox cannot compensate for non-security-minded developers”? After reading this and the discussion, the only thing which seems certain is that the vk.com developers need to set XFO.
it would be good unless following fact - many developers DONT follow HTML5 tricks, and vk.com is an example. They rely on framebreakers because it worked once and they DONT expect it to get broken someday.