It's a cross-domain iframe, so there is no access to it by the page.

Security is subject to browser exploits, that's true, but that has nothing to do with what you were saying above.