Browser & Web Performance · Senior · Question 49 of 75

What is mutation XSS (mXSS)?

✓Correct answer: Sanitized HTML becomes dangerous after the browser parses and re-serializes it, because parsing changes the structure
2XSS caused by CSS mutations
3XSS that only works after a DOM MutationObserver fires

Explanation

This is why sanitizers must use the browser's own parser and be kept up to date, and why output should not be parsed twice.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.