All the articles with the tag "cross-origin".
Practical iframe security: what actually goes wrong and how to lock things down without breaking your app.