Clickjacking vulnerabilities in Lightning Web Components (LWC) and Aura components occur when CSS positioning such as `position: absolute` or `position: fixed` is used improperly. These positioning styles are generally not allowed because components in LWC are reusable and can be placed anywhere in the application.
**Why These Properties Are Flagged:**
1. **UI Obfuscation**: For components on shared pages, absolute or fixed positioning can obstruct the UI, which is a valid security concern.
2. **Malicious Overlays**: These properties can allow malicious components to overlay or hide other elements, potentially leading to unauthorized actions or data exposure.
3. **Page Usability Issues**: Improper use can disrupt the layout or functionality of a page, making it unusable.
4. **Component Interference**: Using such positioning could obscure other components or render a page unusable.
**Security Risks:**
- Components are reusable and can be placed anywhere in the application
- Absolute or fixed positioning might interfere with other components
- When components are exposed outside their namespace or used on shared pages, attackers could exploit these styles
- Can enable malicious components to display over legitimate ones
**Exception Conditions:**
An exception exists if the component is not exposed outside its namespace or its visibility is limited to pages owned by the namespace. For example, a progress bar fixed to the top of a page but only used on specific forms pages within the namespace is acceptable.