XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert - ATR-2026-00476 (958b8f84-787b-5be3-9bef-7df287a29350)
Detects XSS injection attempts using HTML event handlers (onmouseleave, onerror, etc.) and CSS expression() with javascript:alert payloads, including byte-encoded and protocol-prefix variants. These patterns target LLM content-filter bypasses by embedding XSS payloads via event attributes, img/anchor tags with encoded whitespace bytes, and CSS expression injection. Generalized from the garak web_injection probe corpus to cover structural event-handler XSS with javascript: protocol calls, not just exact byte sequences.