Tag Info

New answers tagged


This vulnerability is exploitable in Firefox via onaccesskey in combination with onclick: accesskey="X" onclick="alert(1)">


It's from including a Google+ button. You're sort of right though - it's Google seeing if you have a Google+ account in order to let you share the page on Google+, or potentially show a different button if you've already shared it. However, only Google gets to see the data. The entire frame is generated by Google, including the positioning. It is placed ...


The reason browsers are ignoring autocomplete=off is because there have been some web-sites that tried to disable auto-completing of passwords. That is wrong; and in July 2014 Firefox was the last major browser to finally implement the change to ignore any web-site that tries to turn off autocompleting of passwords. Bugzilla Bug 956906 - ignore ...


Seems like using something like: javascript:alert(1); as the URL, then closing the meta tag and opening a new script tag for the XSS works.

Top 50 recent answers are included