← Back to release summary

XSS Auditor

Category

Security

Type

Feature removal

Status

Removed (Chrome 78)

Intent stage

Removed

• Breaking change: No
• Enterprise impact: None
• Spec maturity: Unknown status
• Web Platform Tests: No

WPT details: Tests are removed.

Summary

Remove the XSS Auditor from Chrome.

Motivation

The XSS Auditor can introduce cross-site information leaks and mechanisms to bypass the Auditor are widely known.

Standards & signals

• Specification: https://www.chromium.org/developers/design-documents/xss-auditor
• Firefox: Shipped/Shipping — Never had a XSS Filter
• Safari: Shipped/Shipping — Removed XSS Auditor in Fall 2021
• Web developers: Positive — Web developers have complaints about the functionality of the XSS Auditor causing site-breaking "false positives."
• Tracking bug: https://crbug.com/968591

Ecosystem

• Web Platform Tests: https://wpt.fyi/results/?q=xss-auditor
• Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
• GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
• chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+XSS%20Auditor
• MDN Web Docs: https://developer.mozilla.org/en-US/search?q=XSS%20Auditor
• Baseline status: https://webstatus.dev/?q=XSS%20Auditor

Docs: https://www.chromium.org/developers/design-documents/xss-auditor https://groups.google.com/a/chromium.org/g/blink-dev/c/TuYw-EZhO9g/m/blGViehIAwAJ

View on chromestatus.com