An attack technique where malicious JavaScript code is inserted into a web application's input fields, allowing attackers to execute unauthorized commands in users' browsers.