I've tried to verify some vectors from OWASP XSS CheatSheet which exploits style attributes

STYLE tag using background-image

<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
STYLE tag using background

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<TABLE BACKGROUND="javascript:alert('XSS')">
Just like above, TD's are vulnerable to BACKGROUNDs containing JavaScript XSS vectors:
<TABLE><TD BACKGROUND="javascript:alert('XSS')">

But none of them seem to be working in the latest browsers - IE10, IE11, Chrome, Firefox, Safari.

Are they valid XSS vectors?

1 Answer 1


OWASP's XSS Filter Evasion Cheat Sheet clearly states that the cases you mention are for old browsers

Deprecated Tests (Works on IE 6 and older browsers)

These are the tests that have only been confirmed to work on IE 6 unless specified otherwise and do not work on any modern browsers as of March 12th, 2014.

Remember, though, not all of your users use up-to-date browsers.

One example is the <img src="javascript:alert('xss')" /> attack. I never thought I'd worry about it until one of our clients reported that whenever he tried to access one order's page on their inventory system, he'd get redirected to a pornographic website. I found the offending row in the database, but was never able to reproduce the redirect until I learned that he used IE6.

  • 1
    Ha! Yeah right, "the browser took me here boss". The perfect alibi.
    – deed02392
    Mar 25, 2014 at 9:48
  • 2
    The OWASP XSS FIlter Evasion Cheat Sheet no longer states this
    – bodhizero
    Feb 5, 2016 at 1:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .