Documenting the impossible: Unexploitable XSS labs
Summary: PortSwigger researcher Gareth Heyes published an 'impossible labs' section on the company's XSS cheat sheet on 22 May 2020, containing 8 labs that each define a small cross-site scripting problem its research team could not solve well enough to pop an alert. The labs cover scenarios such as an open tag followed by an alphanumeric character, an injection inside a JavaScript variable with quotes and forward/backslashes escaped, a 15-character HTML context limit, a 14-character attribute limit, and a frameset injection with equals filtered, with the team reaching scriptless attacks like dangling markup injection in some cases.
Key Takeaway: The premise is that if you find one of these scenarios in the wild and cannot exploit it, you can have reasonable confidence nobody else knows how to exploit it either - a judgment call resting on 8 unsolved labs from one research team, not a proof of safety.
Read the original at PortSwigger Research ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026