XSS in hidden input fields
Summary: PortSwigger researcher Gareth Heyes found that an XSS payload placed inside a hidden input element can be executed in Firefox by binding an onclick event to an accesskey, which the victim triggers with ALT+SHIFT+X on Windows/Linux or CTRL+ALT+X on OS X. The technique, later noted to work in Chrome and in link elements where only attributes are controllable, was found by Liam in an unnamed popular web application whose security team had not responded after 12 days and a couple of emails.
Why it matters: Hidden-input XSS was long treated as nearly unexploitable because invisible elements can't fire onmouseover or onfocus, so a payload that only needs one keypress from the victim changes the risk calculation for any reflection sitting in a hidden field or link attribute.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026