Clickjacking · passage 11 of 12

Chrome 4.0 XSSAuditor filter

1 code block · Clickjacking/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

It has a little different behaviour compared to IE8 XSS filter, in fact with this filter an attacker could deactivate a “script” by passing its code in a request parameter. This enables the framing page to specifically target a single snippet containing the frame busting code, leaving all the other codes intact. Attacker View:

<iframe src=”http://target site/?param=if(top+!%3D+self)+%7B+top.location%3Dself.location%3B+%7D”>

Every one of the 12 is a mark on the map. Named now: 1 to 12, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.