X (Formerly Twitter): Highly wormable clickjacking in player card

Hi, I would like to report an issue where player card is vulnerable to clickjacking in certain browsers. This may result in something similar to XSS worm and many other critical damages. Details Twitter Player Card allows a website to embed a custom playerhtml into an iframe in a tweet. There are...