jordanmilne / nicholson Goto Github PK

The scroller divs don't seem to get scrolled properly when using the default browser on Android 2.3.3.

If a page has a variable amount of content between it and the clickjacking target, and the content can't be guessed by the attacker, clickjacking by scrolling from the top of the document generally won't work.

However, if we will know the ID of an element after the variable height content, we can append it to the URL, the inner iframe will scroll to that element, then we can scroll the outer scroller div the rest of the way to the target.