alert() is dead, long live print()
Summary: Google Chrome 92, landing on 20 July 2021, disables alert() for cross-domain iframes to stop malicious adverts from using dialogs to distract and social engineer visitors. PortSwigger Research notes the mitigation blocks all dialogs, including prompt and confirm, and proposes print() as the replacement payload for proving XSS inside cross-domain iframes.
Why it matters: XSS proof-of-concept payloads built on alert() will stop firing inside cross-domain iframes once Chrome 92 ships, so any detection or training material that depends on a popup needs reworking around print().
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026