An embedded iframe is a webpage loaded inside another webpage, usually through an HTML iframe element. It looks like part of the parent page, but it may come from a different origin, domain, or application. That separation matters because browsers enforce the same-origin policy to limit what the framed content can read or control.
In security work, iframes are important because they can become a cross-origin attack surface. A malicious site may try to trick a trusted page into loading attacker-controlled frame content, or use a frame to probe login flows, steal tokens, or influence browser-extension logic. Defenders reduce risk with origin checks, frame-busting controls, Content Security Policy, sandboxing, and careful handling of messages between frames. When a sensitive tool such as a password vault trusts an embedded frame too much, the frame can become a path to authentication material.