New XSS vectors
Summary: PortSwigger researcher Gareth Heyes, updating the company's XSS cheat sheet in April 2022, found that transition events could fire without a style block by targeting the outline property, since Chrome adds an outline to focusable elements for accessibility. He also described SVG vectors in which a browser update let embedded SVG inside data URLs of a "use" element execute JavaScript automatically, with animate tags able to change the element's href to trigger execution.
What's compelling: These are cross-site scripting bypasses that work with any focusable tag and need no style block, so a filter or sanitizer tuned to the older vectors would let them through.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026