vela-browser-test

Verifying XSS payload execution in a real browser requires running sanitized markup in a live Chromium environment using Playwright. This approach distinguishes inert markup from active browser behavior, confirming whether dangerous strings survive sanitization and actually fire.

Sanitizer validation with real browser probing loads production deck sanitizers to filter dangerous strings, then executes the surviving markup in Chromium. This detects whether inline SVG, image, background-image, or object-based vectors actually trigger outbound requests or execute scripts.

Yes, testing exfiltration and SVG security vulnerabilities is possible using Playwright and jsdom. This environment runs payloads in a prebuilt Chromium executable to verify whether vectors fetch network resources or stay inert after passing through production sanitizers.

The best way to test CSS background-image exfiltration is executing the payload in a real Chromium browser via Playwright. This validates whether the sanitized CSS rule actually triggers an outbound network request within a controlled remote execution container.

A sanitized SVG might still execute scripts if the production sanitizer layer fails to strip dangerous attributes. Running the payload in real Chromium confirms whether the inline SVG vector survives sanitization and fires, proving active browser behavior.

You need a prebuilt Chromium binary to validate object-based XSS vectors. The remote execution container includes this binary and Playwright to probe whether the object element actually executes or fetches network resources after sanitization.