We have a web app and we send the back URL through post to various pages to enable users come back to the parent.
The double quotes are translated to
" to avoid XSS and then translated back. The final tag is like this - form name="back_url" action="server side script" method="post". These double quotes are creating the "Token contains a reflected XSS vector" error. Once I remove the double quotes like form name=back_url action=server side script method=post , the back button works. This issue is only in Chrome. Not sure how to resolve this.