UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36

Steps to reproduce the problem:
1. Open any webpage containing an area to insert text.
2. Enter a script (ie. `<script>alert(1);</script>`)
3. Press Tab

What is the expected behavior?
JS is not meant to execute.

What went wrong?
Javascript executes creating a possible XSS. If put with creativity, this can end up being a stored XSS when victims are social engineered into "editing" a comment, until they are told to press Tab, in which the script will execute.

Did this work before? N/A 

Chrome version: 51.0.2704.103  Channel: n/a
OS Version: 10.0.14372
Flash Version: Shockwave Flash 22.0 r0

Ineffective on creative div-style text areas.

Confirmed that this is not a specific website issue - MS Edge does not have the same behavior.