The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.