---
id: 5468
title: "Bypassing Firefox's HTML Sanitizer API"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-firefoxs-html-sanitizer-api"
published_at: "2022-07-04T07:46:00Z"
tags: ["browser-security", "firefox", "xss", "svg", "html-sanitizer", "sanitizer-bypass"]
phying_url: "https://phying.com/item/5468"
lang: en
---

# Bypassing Firefox's HTML Sanitizer API

## Summary

Gareth Heyes bypassed Firefox's HTML Sanitizer API: SVG 'use' elements importing same-origin absolute URLs still executed JavaScript, even for uploads protected with Content-Disposition: attachment.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-07-04T07:46:00Z
- **Original:** https://portswigger.net/research/bypassing-firefoxs-html-sanitizer-api
- **Phying News:** https://phying.com/item/5468