Escaping '<' and '>' in attributes – how it helps protect against mutation XSS

Published

2025-06-12 00:00

Collected

2026-07-02 00:29

---
id: 1064
title: "Escaping '<' and '>' in attributes – how it helps protect against mutation XSS"
source_domain: bughunters.google.com
source_url: "https://bughunters.google.com/blog/escaping-and-in-attributes-how-it-helps-protect-against-mutation-xss"
published_at: "2025-06-12 00:00"
tags: ["web-security", "xss", "html", "mxss", "escaping", "specification"]
phying_url: "https://phying.com/item/1064"
lang: en
---

# Escaping '<' and '>' in attributes – how it helps protect against mutation XSS

## Summary

Google's Bug Hunters explain why the HTML standard now escapes angle brackets in attribute values and how this change helps prevent mutation XSS (mXSS) attacks.

## Intelligence Metadata

- **Sources:** bughunters.google.com
- **Published:** 2025-06-12 00:00
- **Original:** https://bughunters.google.com/blog/escaping-and-in-attributes-how-it-helps-protect-against-mutation-xss
- **Phying News:** https://phying.com/item/1064