XSS exploits the browser's trust in a website. When a page renders unescaped user input as HTML, the browser cannot distinguish between the site's legitimate scripts and attacker-injected ones. The ...