---
id: 5506
title: "XS-Leak: Leaking IDs using focus"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/xs-leak-leaking-ids-using-focus"
published_at: "2019-10-09T07:01:00Z"
tags: ["browser-security", "portswigger", "side-channel", "focus", "xs-leak", "cross-origin", "iframe"]
phying_url: "https://phying.com/item/5506"
lang: en
---

# XS-Leak: Leaking IDs using focus

## Summary

Gareth Heyes leaks element IDs cross-domain by abusing URL fragment scrolling and focus events in an iframe, brute-forcing IDs with just a single page load.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-10-09T07:01:00Z
- **Original:** https://portswigger.net/research/xs-leak-leaking-ids-using-focus
- **Phying News:** https://phying.com/item/5506