demo · v144

XXE Probe

Paste an XML payload referencing an external entity, click parse — the page runs it through DOMParser and reports whether the entity was resolved (vulnerable) or ignored (fixed in Chrome 144).

not parsed

DOMParser result will appear here

the change

// Before Chrome 144: DOMParser would fetch external entities synchronously.
// Now: external entity references are ignored entirely.
const doc = new DOMParser().parseFromString(xml, 'application/xml');
// doc.documentElement.textContent → empty for &ext; (no resolution)

see also