0b3ada29_er_enabled_Cross_Site_Requests__Site_Communication_Mechanisms_Security_Considerations
[Description of Mechanism] Mutually agreed upon location.hash toggling between iframes (fragment identifiers in URLs), which take place in sequential order. [Conforming User Agents] All (pending investigation) Very complicated to implement. Requires polling for data (slow). Messes up navigation history. See location.hash toggling. [Security Considerations] 
XSS Cookies and Auth (private data) can be sent with requests, and user is unaware that such requests are taking place Data stream is unprotected; malicious content injection is possible (XSS). Browser may treat hash setting as user navigation, which could get stored in history.
Browser-enabled Cross Site Requests
Security Considerations