Almut

> @brandyscarney You are right (any-hover: hover) should help but seems on android 9 it evaluates to **true** > maybe safer test would be like: > > ``` > @media...

This is an even bigger issue with Angular 12! The webpack config is not exposed in Angular. I found a workaround, but it's 🥴 I had to add a path...

I can still reproduce this issue with 4.1.4. Though for the alert to show, I needed to slightly adjust the example of the original post (with additional quotes) `https://example.com/" onmouseover="alert('xss')"`...

Having similar issues with an Angular 8 app, which are fixed when manually using the newest version of the extension. Please upload it to the chrome web store.