When alert fails: exploiting transient events
Summary: PortSwigger researcher Gareth Heyes found that the onpagehide event handler on the body tag can be used to slip past WAFs that block standard events and common XSS vectors, though Chrome blocks prompts fired from it. Because fetch, XHR and image requests did not complete during the transient event, he used navigator.sendBeacon to send a POST request carrying cookies or DOM contents to a remote server, a technique he says also works with onunload and onbeforeunload.
Bottom line: A WAF tuned to block known event handlers and XSS vectors can still miss transient events like onpagehide, and sendBeacon - the same mechanism Google Analytics uses to report on page exit - gives an attacker a working channel to exfiltrate cookies and DOM contents.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026