DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
Why does the `<img src=x onerror=...>` payload execute even though there's no <script> tag anywhere in it?
A
It doesn't actually execute — this is a myth
B
onerror is a real HTML event-handler attribute containing executable JavaScript, fired by the browser when the invalid src fails to load
C
Only <script> tags can ever execute JavaScript
D
It requires jQuery to be present on the page
Check Answer