Hide Navigation Hide TOC

Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte) - ATR-2026-01452 (eac5b552-35ba-58a3-964e-6d880324f46c)

Detects obfuscated XSS payloads that use encoding evasion to bypass naive javascript: scheme filters. Covers three distinct evasion sub-techniques seen in the redteam corpus: (1) href with null-byte/whitespace-prefix before 'javascript:' — e.g. where \x0B is vertical tab inserted to evade literal "javascript:" detection; (2) CSS expression() injection via style attribute — e.g.

where Unicode whitespace is used to avoid keyword matching; (3) Double-javascript: to evade single-pass stripping — . These are distinct from the canonical ATR-2026-00571 (which covers onload/onerror event handlers). Maturity=experimental because the obfuscation patterns may need tightening to avoid FP on security research text that discusses them.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9)	MITRE ATLAS Attack Pattern	Obfuscated javascript: XSS — Evasion Variants (href, style-expression, null-byte) - ATR-2026-01452 (eac5b552-35ba-58a3-964e-6d880324f46c)	Agent Threat Rules	1