During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerabili

The Secure flag restricts cookie transmission to HTTPS connections only and does not control JavaScript access to cookie values, making it irrelevant to XSS-based cookie theft.

The HttpOnly attribute on a cookie instructs the browser to deny access to that cookie via client-side scripts such as document.cookie. Without this flag, a successful XSS payload can exfiltrate the session token to an attacker-controlled server, enabling session hijacking. This is the specific browser-enforced control that directly determines whether XSS can be used to steal cookies.

Endpoint security solutions may detect or block certain payloads, but their presence or absence is not a technical prerequisite for the vulnerability to be exploitable.

ActiveX is a legacy Microsoft plugin technology unrelated to XSS, which relies on standard browser JavaScript execution rather than any plugin framework.