Zero-click XSS is a cross-site scripting flaw that runs malicious JavaScript without the victim having to click a link, open a separate prompt, or otherwise deliberately trigger the payload. It usually appears when an application stores attacker-controlled content and later renders it in a browser context with insufficient sanitization.
This matters because XSS can steal session cookies, rewrite page content, exfiltrate data, or perform actions as the user. In webmail and other rich-content apps, zero-click behavior is especially dangerous: simply previewing a message, contact entry, or embedded HTML can activate the payload during normal use. Defenses include strict output encoding, robust HTML sanitization, content security policy, and reducing or isolating active content. Stored XSS is often harder to spot than reflected XSS because the malicious input may sit quietly until a later view loads it.