A penetration tester notices that the X-Frame-Optjons header on a web application is not set. Which of the following would a malicious actor do to exploit this configuration setting?

Path modification to escape an application framework describes a path traversal or framework-escape vulnerability class that is entirely unrelated to the X-Frame-Options header.

The X-Frame-Options header instructs browsers to prevent the page from being embedded in a frame by another origin. Without it, an attacker can load the target application inside an iframe on a malicious page, overlay deceptive UI elements on top, and manipulate users into performing actions - such as clicking buttons or submitting forms - without their knowledge.

Injecting a malicious iframe containing JavaScript describes a cross-site scripting vector and is not the direct exploitation of a missing X-Frame-Options header, which specifically enables clickjacking.

Passing a malicious iframe attribute relates to HTML attribute injection, not the clickjacking risk that arises specifically from an absent X-Frame-Options header.