The bottom line: JavaScript can be a very powerful workaround for many limitations or requirements, but in the case of “noindex” it simply won’t work to cancel out the impact of a noindex ...

In this case, JavaScript running in an iframe can redirect the top page to a malicious site, which can then override core JS functions, leading to a full escape to RCE.