HTML Smuggling

HTML smuggling embeds encoded data in an HTML page or attachment and uses browser-side JavaScript, such as Blob or data URL handling with a download action, to reconstruct a file on the endpoint. An Internet-delivered link or email attachment can reach a victim without internal network access or a prior execution foothold, but successful delivery and a user opening the page are still required. Because the file can be assembled client-side, some content filters may not inspect the reconstructed file; email, web, browser, and endpoint controls can still detect or block delivery. Opening the page does not by itself execute the downloaded file or establish command and control.