---
id: 5447
title: "Exploiting XSS in hidden inputs and meta tags"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/exploiting-xss-in-hidden-inputs-and-meta-tags"
published_at: "2023-07-11T13:00:00Z"
tags: ["web-security", "xss", "chrome", "popover-api", "hidden-inputs", "meta-tags"]
phying_url: "https://phying.com/item/5447"
lang: en
---

# Exploiting XSS in hidden inputs and meta tags

## Summary

Abusing Chrome's new popover API to exploit XSS in hidden inputs and meta tags: onbeforetoggle events fire on popover targets, bypassing attribute blocklists and enabling script execution.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-07-11T13:00:00Z
- **Original:** https://portswigger.net/research/exploiting-xss-in-hidden-inputs-and-meta-tags
- **Phying News:** https://phying.com/item/5447