---
id: 5549
title: "Noscript XSS filter bypass"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/noscript-xss-filter-bypass"
published_at: "2019-06-14T12:00:00Z"
tags: ["web-security", "javascript", "bypass", "noscript", "xss-filter"]
phying_url: "https://phying.com/item/5549"
lang: en
---

# Noscript XSS filter bypass

## Summary

Gareth Heyes finds a NoScript XSS filter bypass using __defineSetter__ to trigger arbitrary function calls in script context, with window.name delivery across domains. Since patched.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-06-14T12:00:00Z
- **Original:** https://portswigger.net/research/noscript-xss-filter-bypass
- **Phying News:** https://phying.com/item/5549