Top 10 winner

Mario Heiderich -- Mutation XSS

The inner HTML Apocalypse : How MXSS attacks change everything we believed to know so far

Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang · ACM

Reading innerHTML makes browsers rewrite markup, so a string that passes every server- and client-side XSS filter can be mutated into a live vector. Seven mutations are named - backticks as attribute delimiters, XML namespaces on unknown elements, CSS escapes, entity handling in XML modes - and broke Yahoo! Mail, Roundcube, HTML Purifier and Caja. An 820-byte XMLSerializer shim blocks them.

Record

Document

The inner HTML Apocalypse : How MXSS attacks change everything we believed to know so far

Researcher

Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang

Published by

ACM

Topic

XSS

In the archive

• Ranked #1 in the 2013 Top 10 Web Hacking Techniques

Related sources

• mXSS Attacks: Attacking well-secured Web-Applications by using innerHTML Mutations (Paper) Paper

Tags

• mutation-xss
• xss
• filter-bypass
• sanitizer-bypass
• dom
• encoding
• css
• mitigation
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.