Iframe Webdriver Leak

Detection approach

Iframe sandbox leak: navigator.webdriver is true inside a pristine dynamically-created iframe. Stealth plugins patch the main window but cannot react fast enough to patch newly spawned browsing contexts. This is a guaranteed bot signal used by tier-1 WAF vendors.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

None. Stealth plugins cannot patch newly spawned iframe contexts in time.