Actually if we could all agree to go back to plain HTML, no CSS and especially no JavaScript and use solid client applications for client work; the web would be infinitely more secure. That isn't going to happen though, unfortunately.
Everything has to be same origin. Exceptions only to be allowed with case-by-case explicit consent of the user.
The only thing that should bridge one website to another is a link to the 'top' level document.