Collected research

File System API with HTML5 -- Juice for XSS

File System API with HTML5

shreeraj · shreeraj.blogspot.com

Short note on the HTML5 File System API as an XSS target. Because a site can create a persistent mini filesystem readable by any script in the same origin, an XSS payload can enumerate the entries and read files such as stored tokens. Screenshots show the created files listed in Chrome and the JavaScript access routine.

Record

Document

File System API with HTML5

Researcher

shreeraj

Published by

shreeraj.blogspot.com

Topic

XSS

In the archive

• Collected in the 2012 research round

Tags

• xss
• javascript
• info-leak
• dom
• same-origin-policy
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of shreeraj, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.