When security features collide
Summary: PortSwigger researcher James Kettle showed that Cloudflare's email address obfuscation feature, enabled by default, rewrites forward-slashes into spaces in anchor tags, and that this quirk lets a crafted XSS payload evade Chrome/Safari, Edge/IE, NoScript and Cloudflare's own WAF on any site using Cloudflare. A colleague, Gareth Heyes, then built a second payload using malformed syntax to confuse the cloud-based HTML parser without relying on the slash quirk, and commenters later added variants using XMP and nested scripts with foreign object and replaceChild.
Why it matters: The bypass works because a security feature rewrote the input that other filters were inspecting, so one default-on control defeated several others at once - and the author notes a separate Cloudflare-injected script at /cdn-cgi/ was found to bypass both Chrome's XSS filter and whitelist-based CSP.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026