Finn763
c9d7b22e05
JSON.stringify does not escape '<' — a reloadUrl containing '</script><script>…' would terminate the inline <script> element of the data: error page and let an attacker-controlled URL inject markup/script. Escape <, >, & (and U+2028/U+2029) as \uXXXX sequences after stringify; add regression test.