Frontend & browser·Browser security
your page was loaded in an invisible iframe over someone else's button, and the click landed on yours.
Clickjacking
Also calledUI redressing, frame-ancestors
Framing a target site transparently over attacker-controlled content so the user's clicks are delivered to it unknowingly. The defence is refusing to be framed, with `frame-ancestors` in a Content Security Policy or the older `X-Frame-Options`. Any authenticated page that performs an action on click needs it, which in practice means the whole application.