MXSS Attacks: Attacking well-secured Web Apps by using innerHTML Mutations [pdf]