Other nomination

HTML5 new XSS vectors

Gareth Heyes

HTML5's autofocus attribute gives automatic XSS execution inside an attribute injection where angle brackets are filtered, replacing the need for CSS expressions or -moz-binding. Pairing autofocus with onfocus fires without user interaction on input, select, textarea and keygen elements, working in Safari, Chrome and Opera.

Record

Researcher

Gareth Heyes

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Tags

• xss
• filter-bypass
• html5
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.