Don't Get Clickjacked

Using only CSS and HTML, an attacker can create a transparent IFRAME of a victim web page that contains privileged buttons.

A clickjacking attack can be used to direct seemingly benign mouse clicks to ...privileged buttons. For example, you may think you're playing a game, when you're actually starting a webcam recording. Using only CSS and HTML, an attacker can create a transparent IFRAME of a victim web page that contains privileged buttons.
for source & to read more:http://dotnet.sys-con.com/node/731258