alf.nu / @steike

Firefox Self-XSS

Firefox now has self-XSS protection to the browser console...

... but at about the same time another way to paste script was added.

Put this on the clipboard:

... then press Shift-F2 and paste it.

It obeys CSP rules, but it ignores MIME types (try replacing text/javascript with image/jpeg above), so a bypass is likely.

Complaints to @steike