Collected research

A more plausible E4X attack

Chris Evans · scarybeastsecurity.blogspot.com

Firefox's E4X made raw XML valid JavaScript, so an XML inbox feed pulled cross-domain via a script tag parsed in the attacker's origin. Because E4X evaluates curly braces inside XML values, mail subjects of '{ x =' and a closing quote-brace capture the intervening messages into an attacker variable. Constraints are listed; Mozilla broke the attack in Firefox 3.5.

Record

Researcher

Chris Evans

Published by

scarybeastsecurity.blogspot.com

Topic

Other

In the archive

• Collected in the 2009 research round

Tags

• sop-bypass
• same-origin-policy
• javascript
• parser-differential
• info-leak
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Chris Evans, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.