demo · v138

Serialization Diff

Chrome 138 escapes < and > inside HTML attribute values when serializing. Type any attribute value below to see exactly what outerHTML would produce in an older browser vs Chrome 138+, and whether the difference closes a mutation-XSS window.

Tag
Attr name
Attr value
Presets:
Before Chrome 138 (unescaped)
—
Chrome 138+ (escaped)
—

Step-by-step: what the attack exploits

// Attribute value with angle brackets
const el = document.createElement('div');
el.setAttribute('data-value', '<script>alert(1)</script>');

// Chrome 138+: outerHTML escapes < and > inside attribute values
el.outerHTML;
// <div data-value="&lt;script&gt;alert(1)&lt;/script&gt;"></div>

// Older browsers: raw < > survive serialization
// <div data-value="<script>alert(1)</script>"></div>
//                   ^ parser re-reads this as a start tag on innerHTML re-parse!

see also