Self-XSS is a variety of XSS that relies heavily on social engineering, which is the primary reason it is excluded from most bug bounty programs. Sandboxed XSS, a similar term for a related strain, is typically used to describe an XSS vulnerability that happens on a machine isolated from sensitive user data or operations. Since Self-XSS refers to the specific phenomenon of executing code within your browser environment to make yourself vulnerable to an XSS attack, it also means that your XSS bug is isolated in terms of what information it can access.
For Self-XSS to take place, the attacker must get the victim to execute code within the browser context. That execution is what makes the victim susceptible to further exploitation by the attacker.
A simple example of self-XSS in action would be as follows:
- An attacker advertises...