Cross-origin iframe
A cross-origin iframe is a frame whose content comes from a different origin than the parent page, such as an embedded payment form, video player, or third-party widget. The browser's same-origin policy blocks the parent's scripts from reading it, so a recorder on the parent page cannot capture what happens inside.
How it works
Same-origin iframes are recordable directly; the recorder descends into them like any subtree. Cross-origin frames are opaque by design, and the recording appears as a correctly sized blank region, which is often acceptable and sometimes even desirable (payment iframes staying unrecorded is a privacy feature). When capture is genuinely needed and you control the embedded content, rrweb's recordCrossOriginIframes mode runs the recorder inside the iframe too, relaying its events to the parent recording via postMessage; both sides must load rrweb, and the events merge into one stream. Third-party frames you do not control stay unrecordable, full stop, and replay should communicate the gap rather than render confusing emptiness.
Where you encounter it
Checkout flows, embedded editors, SSO screens, and support tickets asking why part of a replay is blank; setup details are covered by the recordCrossOriginIframes option.