Web Security · Senior · Question 10 of 75
What is mutation XSS (mXSS)?
- 1An XSS attack that only works on mobile browsers
- ✓Correct answer: HTML that looks safe after sanitizing changes when the browser re-parses it, producing executable markup
- 3XSS that changes every time the page loads
Explanation
Differences between the sanitizer's parse and the browser's (for example around <noscript>, SVG or MathML) can be exploited. Sanitize with the browser's own parser and keep the library up to date.