onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet
Summary: PortSwigger Research updated its XSS cheat sheet with community-contributed event vectors, including a Safari-only vector using the onwebkitplaybacktargetavailabilitychanged event on audio and video tags submitted by @amirmsafari. The update also added the onpointercancel event from @Wcraft-log, documented that nearly every element can now use the autofocus attribute, and added previously missed webkit events requiring trackpad interaction, while Mozilla contributed removals of events that no longer work with the marquee tag on Firefox.
What you should know: The cheat sheet's obscure vectors, such as a Safari-only event on audio and video tags, are the ones defenders are least likely to have accounted for when reviewing client-side injection risk.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026