Related to my previous question on XSS in canonical link.

At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not trigger.

" onload="alert(1)

But when I turned ON XSS auditor Chrome gave a warning as follows:

enter image description here

My question is why XSS was not triggered when XSS auditor was OFF ?

1 Answer 1


The XSS auditor can be triggered even if your payload isn't working, and sometimes even if there's no XSS vulnerability at all!

The XSS auditor just looks at the request parameters to check if there's a match with a part of the response.

To understand why your payload isn't working, disable the XSS auditor and look at the HTML source / developer console.

  • Does that mean Chrome's XSS auditor gives a lot of false positives ?
    – Rahul
    Commented Mar 24, 2019 at 22:57
  • @user101: Yes! Those false positives can even be triggered to exploit another type of vulnerability: medium.com/@terjanq/google-books-x-hacking-29c249862f19 Commented Mar 25, 2019 at 6:29
  • @user101: Note that a XSS is present in your example, based on the output from the other question. Chrome detects it and blocks it successfully, even if your payload didn't impact the page in any way. Commented Mar 25, 2019 at 6:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .