In a scenario where an attacker has control over the
src attribute of an
The attacker can not manage to leave the
src context. For example, the code that causes the above cause could be similar to the following:
src (after IE version 6) and
style (after IE version 10) attributes in
script tags? Yes, there are many answers (see above) on Security SE that mention that XSS should not happen in these cases, but is there a guarantee?