Firefox loads XSLT from data: URL in Link header, enabling header-based XSS
jedisct1 · x · 2026-10-27
Security researcher garethheyes disclosed that Firefox will load an XSLT stylesheet from a data: URL in a Link response header; combined with a harmless XML body, this yields JavaScript execution in the page's origin — XSS from a response header. The same disclosure covers Safari importing GIFs as SVG and several sanitizer bypasses.
More from Safety
- Commenters warn cheap unfiltered models and Chinese AI are outpacing the economy — alex_verem · 2026-10-28
- Mantic forecasts open-weight models 9 months behind frontier in offensive cyber capability — tshevl · 2026-10-28
- Fangcun AI publishes third-party safety evaluation of DeepSeek V4.1 Flash-1017 for manipulation risks — pstAsiatech · 2026-10-28
- Study finds no real-world multilingual benchmarks for clinical AI scribes in India — DrDatta_AIIMS · 2026-10-28
- Grim Test finds AI shows no mercy for humans even while causing suffering — hollee-o · 2026-10-28
- Critic slams NYT for platforming 'TESCREAL' AI-safety circles — mjdramstead · 2026-10-28