Is it possible to inject javascript inside of an HTML option tag?
For example, say you have the following html:
<select>
<option MALISCIOUS_CODE_HERE>Option Description</option>
</select>
If you were unable to break out of the tag itself, are there any attributes which would allow you to run javascript (or any other tricks) in this scenario? If this were a div, you could add an onclick event and run javascript this way for example.
<option f="""><SCRIPT>alert("XSS")</SCRIPT>"\>">Option Description</option>