HTML attribute context is the place where application data is inserted inside an HTML attribute value, such as href, value, or title. This context is more dangerous than plain text because characters like quotes, angle brackets, and ampersands can change how the browser interprets the markup. If untrusted input is written here without proper encoding, it may break out of the attribute and alter the page structure.
This matters in web security because reflected and stored XSS often start when user-controlled data is rendered in the wrong context. In an attack, a crafted payload may close an attribute and inject a new one or script-related content. Defenses rely on context-aware output encoding, strict input validation, and safer templates that avoid building HTML strings manually. Treat every attribute as a parsing boundary: what is safe in text content may be unsafe inside an attribute value.