Welcome to my challenge
The goal is to find a way to trigger the alert("You WIN");
An early hint: You do not have to bypass X-Frame-Options: DENY
There are no hidden parameters in chall.php
A working solution is known for the latest Firefox and Google Chrome version.
In case you found a solution write me a DM
SecurityMB (unintended solution in Google Chrome)