While performing online banking using a Web browser, Kyle receives an email that contains an image of a well-crafted art. Upon clicking the image, a new tab on the web browser opens and shows an…

Clickjacking tricks users into clicking invisible or disguised UI elements overlaid on a legitimate page - it does not involve forging authenticated background requests via image links.

Web Form Input Validation is a defensive control, not an attack class - it refers to sanitizing user-supplied input to prevent injection attacks.

Cross-Site Request Forgery exploits the trust a website places in the user's authenticated browser session. When Kyle clicked the image while logged into his bank, the malicious link silently issued HTTP requests to the banking site using his existing session cookies, causing unauthorized fund transfers without his knowledge. The bank's server had no way to distinguish these forged requests from legitimate ones.

Cross-Site Scripting involves injecting malicious client-side scripts into a vulnerable web page to execute in other users' browsers, which is distinct from hijacking an existing authenticated session via forged requests.