Collected research

HTML5 new XSS vectors

Gareth Heyes · thespanner.co.uk

HTML5's autofocus attribute gives automatic XSS execution inside an attribute injection where angle brackets are filtered, replacing the need for CSS expressions or -moz-binding. Pairing autofocus with onfocus fires without user interaction on input, select, textarea and keygen elements, working in Safari, Chrome and Opera.

Record

Researcher

Gareth Heyes

Published by

thespanner.co.uk

Topic

XSS

In the archive

• Collected in the 2009 research round

Tags

• xss
• filter-bypass
• html5
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 17 August 2026.