Modern Browser XSS Filter Evasion

`Modern browsers usually have an antiXSS filter, that protects users from some of the consequences of this kind of attacks. Normally, they block cross site scripting execution, so the "injected" code (normally, JavaScript or HTML) is not executed inside victim's browser. Chrome calls this filter XSSAuditor.  
  
But if the victim visits a website with an XSS problem that an attacker is trying to take advantage of, it would not be fully protected. This bug is based on a misuse of srcdoc attribute of IFRAME tag, included in HTML5 definition. To perform an XSS attack on Google Chrome Browser or Safari using this bug, the website must include an IFRAME and must be able to read any attribute of this element from HTTP parameters (GET/POST) without applying any charset filter. Then, in the IFRAME parameter, the srcdoc attribute may be included with JavaScript code. The browser cannot filter it and will be executed.  
  
An HTML injection on src parameter would be:  
  
iframe src=""srcdoc="<script>alert('Bypass message')</script>"  
  
For a proof of concept, visit:  
  
http://demofaast.elevenpaths.com:9002/xssbypass/iframebypass.php?iframe=%22srcdoc=%22%3Cscript%3Ealert('Bypass%20message')%3C/script%3E  
  
The problem was reported in October, the 23rd. They fixed it two days later, making XSSAuditor catch reflected srcdoc properties even without an "IFRAME" tag injection. Chrome has just fixed it in recent 32.0.1700.76 version.  
  
Safari for Mac and iPhone is vulnerable as well.  
  
  
  
This weakness has been discovered by Ioseba Palop from Eleven Paths ([email protected]<mailto:[email protected]>). Full samples and detailed explanation here: http://blog.elevenpaths.com/2014/01/how-to-bypass-antixss-filter-in-chrome.html  
  
`