Clickjacking
Clickjacking is an attack in which a page the victim trusts is loaded invisibly inside a page the attacker controls, so a click aimed at the visible page is delivered to the hidden one. The victim performs a real, authenticated action without knowing which application received it.
The technique needs nothing exotic: a frame with reduced opacity, positioned so a control the attacker wants pressed sits under a control the victim wants to press. Because the click is genuine and the session is the victim’s own, the request carries valid cookies and looks correct in every log. That is what separates it from cross-site request forgery: nothing is forged, the action is simply misdirected.
The defence is to refuse framing, and there is one control that does it properly: the frame-ancestors directive of a content security policy, which is enforced consistently and can name specific origins. The older X-Frame-Options header is still widely deployed and is fine as a fallback, but it cannot express a list of permitted origins reliably and should not be the only control on a new build. JavaScript that tries to break out of a frame is not a defence; it is trivially neutralised.
In a report it is normally low severity on its own and rises with what the framed action does. A framed one click transfer, permission grant or account deletion is a real finding; a framed marketing page is not. What we record is the specific authenticated action reached and the header actually served on that path, since estates commonly set the policy on the login page and nowhere else. This falls under the web application testing where framing controls are checked on every authenticated page.