↓ Skip to main content

Self-XSS

XSS that only fires in your own account. Getting it reclassified is usually a fight, and usually a fight worth having.

2016

patrik.re

Google Cloud Console: dormant stored XSS

An XSS payload stored as a Google Cloud project name executed months later in the unfiltered project-deletion error message, earning a $5,000 VRP reward, plus the impact argument that got it past a self-XSS classification.