Update navigations.md

content/docs/attacks/navigations.md

@@ -73,7 +73,7 @@ This attack works regardless of any [Framing Protections]({{< ref "xfo" >}}), be
 
 ### Download Navigation (without iframes)
 
-A variation of the technique presented in the previous section can also be effectively tested using `window` objects:
+A variation of the technique presented in the previous section can also be effectively tested using `window` objects, this also uses a sandboxed iframe to prevent a visable file download:
 
 ```javascript
 // Set the destination URL