When injecting into the url part of an HTML META redirect like this:

<meta http-equiv='refresh' content='0;URL=$URL'

where $URL (note the missing quotes) is the part I can inject, is there any way to invalidate the meta tag so it does not redirect immediately and instead run the injected JS? I already tried injecting the content attribute again with a different redirect time, but at least for chrome, this does not work.

1 Answer 1


Seems like using something like: javascript:alert(1); as the URL, then closing the meta tag and opening a new script tag for the XSS works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .