v138 · miscellaneous

Escape "<" and ">" in attributes on serialization

Escape "<" and ">" in values of attributes on serialization. This mitigates the risk of mutation XSS attacks, which occur when value of an attribute is interpreted as a start tag token after being serialized and re-parsed.

concepts

  1. Attribute Escape

    Outer HTML serialisation now escapes < and > inside attribute values. Closes a class of XSS where outerHTML round-trips produced different DOMs.

  2. mXSS round-trip

    A real mutation-XSS attack pattern reconstructed step-by-step: input → attribute → outerHTML → re-parse. The verdict panel flags whether the DOM survived the trip.

  3. Serialization Diff

    Side-by-side: what pre-138 browsers serialised vs Chrome 138+. Type any attribute value and instantly see which characters changed and whether the old output opened a mutation-XSS window.

  4. Mutation XSS playground

    Type an attribute value containing < and >, step through the full mXSS attack path (write → serialise → re-parse), and see whether the Chrome 138 escaping prevents DOM injection. Character-level diff shows exactly what changed.

why it shipped

Escaping "<" and ">" in attributes mitigates the risk of mutation XSS attacks, which occur when value of an attribute is interpreted as a start tag token after being serialized and re-parsed.

references