Redefining Impossible: XSS without arbitrary Java Script
Summary: PortSwigger's impossible XSS lab restricted injection to a single-quoted JavaScript string using only the charset a-zA-Z0-9' + . `, and researcher Luan Herrera solved it without arbitrary JavaScript by building a character-by-character oracle from split(), repeat(), and match(). He then leaked document.cookie cross-origin by calling window.stop() to suppress the iframe load event when a character didn't match, while a match let location.assign() redirect and fire the load event.
Key Takeaway: The exploit needs no arbitrary code execution, only a restricted charset and an iframe, so a cookie can be read one character at a time through load-event timing that standard XSS filters and CSP script rules were never designed to catch.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026