Edge XSS filter bypass
Summary: Researcher Gareth Heyes reported an Edge cross-site scripting filter bypass to Microsoft on 4 September 2015, and it remained unfixed when he published the details in April 2016. The technique combines an older object-literal trick that routes a constructed string through the location object with ES6 computed properties, which obfuscate the toString and valueOf names that Edge's filter regexes look for.
Why it matters: Edge's XSS filter was the control meant to catch this class of attack, and a filter that can be evaded by renaming properties in ES6 offers little protection to anyone relying on it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026