UXSS, or Universal Cross-Site Scripting, is a flaw in a browser, extension, or related component that lets attacker-controlled content run as if it were part of a trusted site. Unlike a normal XSS bug inside one web app, UXSS breaks the browser’s trust boundary and can bypass same-origin protections that are supposed to keep sites isolated.
This matters because a successful UXSS can expose session data, tokens, messages, or page content from otherwise protected sites. In real attacks, it often appears through buggy extension logic, unsafe content scripts, or parsing errors that let one origin influence another. Defenders reduce risk by patching browsers and extensions quickly, limiting host permissions, separating sensitive browsing into dedicated profiles, and treating any component that can read page content as part of the attack surface.