Welcome to the private homepage of Johannes Jarolim, Salzburg, Austria, Europe. Willkommen auf der privaten Homepage von Johannes Jarolim, Salzburg, Österreich.

Microsoft has done it again: Just noticed that some customers aren’t able to open select boxes in some iFrames when using IE7.

After some investigation and prototyping i came up with the following:


Select boxes in iFrames may not be opened anymore.

Analysis (short)

Microsoft has busted iFrame interaction in IE7 via windows update.

Analysis (long)

With IE7, Microsoft has introduced a security concept to deal with Cross-Frame-Scripting: http://msdn.microsoft.com/en-us/library/ms533028%28v=vs.85%29.aspx

This security layer prevents JavaScript from interacting between the iFrame-Scope-Border if the iFrame gets hosted on another domain as the including page.

After running Windows-Update, those security restrictions also covers basic interaction with Select-Boxes: If served via another domain, Internet Explorer circumvents users to open Select-Boxes in iFrames.

If we set up a valid document.domain constallation between container page and iFrame, Select-Boxes may be used correctly again.


Opening Select-Boxes with the mouse has nothing to do with Cross-Frame-Scripting imho: This is a major bug in Internet Explorer 7.


  • Serve iFrame content via the same domain as the container page
  • Serve iFrame content via a subdomain of the domain serving the container page. Correctly set up document.domain on both pages (container, iFrame)

Update 2011-11-22

Seems this was caused by the Cumulative Security Update for Internet Explorer: October 11, 2011.

LOL: Microsoft itself advices to update to IE8/IE9 or to install a hotfix for IE7 as described in Knowledgebase Article 2628724 – That means your visitors have to install a browser-hotfix to use a normal iframed page correctly.

Six Replies

  1. 24. October 2011, 09:42
    Comment by Matthias Franke
    I have analyzed this problem, too. But my solution for this problem is: No solution!

    If you find any hack for this, please let us know!
    • 24. October 2011, 18:39
      Comment by Johannes
      There is a doable solution/workaround: Serve the iframe content via a subdomain of the main domain and set up a correct document.domain constellation.

      I'm not speaking here about monetary implications in real live but about doability ;-)
  2. 24. October 2011, 18:26
    Comment by Eugene
    Thumbs up to M$ once again lol. If you find a solution, I'd like to know it too. Any idea which particular update caused it?
  3. 26. October 2011, 12:53
    Comment by Matthias Franke
    There is no great solution available. I can´t setup a subdomain/main domain environment.

    My solution is, to change the size attribute of the select tag to a value greater than 1 for IE7. It´s now displayed as a listbox. Not beautyful, but usable.

    The Code:
    try {
    } catch (e) {
    if ( jQuery.browser.msie && /MSIE 7\.0/i.test(window.navigator.userAgent)) {
  4. 8. November 2011, 16:17
    Comment by Mike Padgett
    Just noticed this today too. Very, very annoying but one small consolation is that it's a recent issue. Thanks, Johannes!
  5. 7. December 2011, 19:23
    Comment by Connie DeCinko
    Matthias, where are you putting that code?

You're welcome to leave a message here

Reload Image