This question already has an answer here:

I've been looking at a few issues related to XSS. In doing so, I've stumbled upon a few "XSS Filter Evasion" type checklists that demonstrate supposed XSS via data URIs. For example:

It's obvious that clicking a link (such as the one below) would cause an alert to appear in the browser.

<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">test</a>

However, this code (as far as I can tell) will not be executed on the same origin as the page that contains the anchor tag.

Why are people calling this an XSS vector? Is there something I'm missing that makes this an issue?

marked as duplicate by tim, TheJulyPlot, WhiteWinterWolf, Xander, Steffen Ullrich Jul 21 '17 at 16:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

However, this code (as far as I can tell) will not be executed on the same origin as the page that contains the anchor tag.

As of July 2017, that's true for Google Chrome but not Mozilla Firefox (and possibly other browsers that aren't WebKit-based). However, Mozilla is currently working to change that behavior.

So, a click on this link in Firefox will alert the current domain, making it a full-impact XSS vulnerability:

<a href="data:text/html,<script>alert(document.domain)</script>">click</a>

I'm quoting a developer from this bug report:

In Firefox data: URIs inherit the security context of the page from which they're opened, just like javascript: URIs. This includes access to cookies. This is a well-known aspect of how we handle data: URIs. Up until relatively recently the HTML spec aligned with what we did. This changed, and now we are slowly working to change this behaviour (but that change is a fundamental one and doesn't happen overnight).

But even without an inherited origin you should avoid allowing user-supplied data URIs where the application expects an ordinary web link, as explained in this thread.

Not the answer you're looking for? Browse other questions tagged or ask your own question.