---
id: 5490
title: "When alert fails: exploiting transient events"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/when-alert-fails-exploiting-transient-events"
published_at: "2020-09-08T12:27:00Z"
tags: ["web-security", "xss", "waf-bypass", "transient-events", "sendbeacon", "onpagehide"]
phying_url: "https://phying.com/item/5490"
lang: en
---

# When alert fails: exploiting transient events

## Summary

Exploiting transient events like onpagehide when prompts are blocked: fetch and XHR cannot complete as pages unload, but navigator.sendBeacon lets payloads exfiltrate cookies and DOM data.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-09-08T12:27:00Z
- **Original:** https://portswigger.net/research/when-alert-fails-exploiting-transient-events
- **Phying News:** https://phying.com/item/5490