---
id: 5502
title: "XS-Leak: Detecting IDs using Portal"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/xs-leak-detecting-ids-using-portal"
published_at: "2020-09-08T12:26:00Z"
tags: ["browser-security", "portswigger", "side-channel", "css", "xs-leak", "portal", "x-frame-options"]
phying_url: "https://phying.com/item/5502"
lang: en
---

# XS-Leak: Detecting IDs using Portal

## Summary

Gareth Heyes uses Chrome's experimental portal element to bypass X-Frame-Options and detect applications like phpMyAdmin via focus events, including a CSS-only variant.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-09-08T12:26:00Z
- **Original:** https://portswigger.net/research/xs-leak-detecting-ids-using-portal
- **Phying News:** https://phying.com/item/5502