> I'm quite surprised that these exploits aren't blocked at the browser level... I'm suggesting we're at the point now where browsers should be secure by defaul

> I'm quite surprised that these exploits aren't blocked at the browser level... I'm suggesting we're at the point now where browsers should be secure by default, even if it breaks some old sites. Some are. But in general, XSS (especially reflected) are not possible to block exclusively at the browser level. > For example, if browsers flatly refused to load code from an external URL unless the address was whitelisted in the page's HTTP response headers then you'd make level 6's exploit impossible without much of an impact on web development. See fastest963's comment.