CSS proof-of-concept of clickjacking attack. Use pointer-events:none to allow clicks flow through to element underneath. There are two elements on the page: Twitter's "Follow me" iframe-button and absolutely positioned div with normal link inside. But the div has pointer-events: none, therefore click on the link will be propagated into iframe underneath. I made div and link semi-opaque for demonstration purpose.

Follow @podlipensky

Microsoft and Opera voted for withdrawal of the spec because of possible clickjacking issues. But they still support pointer-events for SVG element. See example below (IE9+ and Opera):

Follow @podlipensky Click me, please!

Another workaround for some older IE versions (IE6-8, but not 9) is to conditionally fallback to DXImageTransform.Microsoft.AlphaImageLoader.

Follow @podlipensky