Why XSS still matters: MSRC’s perspective on a 25-year-old threat
https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0791/