XS-Leak: Leaking IDs using focus
Summary: PortSwigger researcher Gareth Heyes found that in Chrome and Safari, setting an element's ID in a URL fragment scrolls to that element and fires a focus event, which can be triggered cross-domain through an iframe. Because the fragment is not sent to the server, an attacker can load the target domain once and change the hash repeatedly to bruteforce IDs, detecting a hit via the window.onblur event, as shown in a proof of concept published on 8 October 2019.
Bottom line: A single page load is enough to enumerate element IDs on another domain, so any site whose IDs reveal internal structure or state can be mapped without the server seeing more than one request.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026