---
id: 5542
title: "Edge XSS filter bypass"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/edge-xss-filter-bypass"
published_at: "2019-06-14T12:10:00Z"
tags: ["browser-security", "microsoft", "bypass", "edge", "xss-filter", "es6"]
phying_url: "https://phying.com/item/5542"
lang: en
---

# Edge XSS filter bypass

## Summary

Gareth Heyes explains an unfixed Edge XSS filter bypass combining a legacy IE location-object trick with ES6 computed property names to obfuscate toString/valueOf. Reported to Microsoft in 2015.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-06-14T12:10:00Z
- **Original:** https://portswigger.net/research/edge-xss-filter-bypass
- **Phying News:** https://phying.com/item/5542