Other nomination

Firefox uXSS and CSS XSS - Abdulrahman Al-Qabandi

Abdulrahman Al-Qabandi

A Firefox regression let a javascript URI run from a CSS background-image through the View background image context-menu item. Because an open context menu still acts on whatever page the window has navigated to, calling history.back() from oncontextmenu makes the script run in a cross-origin page, giving universal XSS that also sidesteps CSP and NoScript.

Record

Researcher

Abdulrahman Al-Qabandi

In the archive

• Nominated for the 2018 Top 10 Web Hacking Techniques

Tags

• xss
• css-injection
• sop-bypass
• csp
• filter-bypass
• javascript
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Abdulrahman Al-Qabandi, first published at the original source. Preserved copies are kept so the citation survives its host.