news
PortSwigger Research
October 27th, 2026 at 2:29 PMScalable Vector Grief
I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.
Get stories like this every Monday
The week's most important AI news in one email. Free, unsubscribe anytime.
Score: 2.15
Engagement proxy: 0
Canonical link: https://portswigger.net/research/scalable-vector-grief