demo · v144 · security

XXE Side-by-Side

Edit two XML documents — one with a harmless internal entity, one trying to pull file:///etc/passwd. Parse both via DOMParser and observe how Chrome 144 handles each. External entities should resolve to nothing.

DOMParser: present

SAFE: internal entity

XXE attempt

click to parse

the API

const dp = new DOMParser();
const doc = dp.parseFromString(xmlStr, "application/xml");
// External SYSTEM entities are NOT fetched by the browser parser.
// They expand to the empty string. Chrome 144 confirms the policy.

see also