If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!
Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.
We’ll talk about mXSS and HTML parsing as background and then also explain why the XSS Auditor didn’t work (as a prime example of a browser-controlled XSS mitigation). Using examples from recent mXSS attacks against sanitizers, we are explaining the root cause of these issues and the solution: Parsing needs to be done within a context-element. Then we will explain how a built-in Sanitizer API can fill the existing gap and what it can and can not protect against, looking at more recent attacks like DOM Clobbering and script gadgets.