During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerabili

The Secure flag restricts cookie transmission to HTTPS connections only; its presence or absence has no bearing on whether JavaScript can read cookie values on the client side.

The HttpOnly attribute on a cookie instructs the browser to block client-side scripts, including JavaScript, from accessing the cookie via the document.cookie API. Without this flag, an injected XSS payload can read and exfiltrate the session token to an attacker-controlled server. This missing flag is the direct technical prerequisite for cookie-theft-based session hijacking via XSS.

The absence of an endpoint security solution may reduce the chance of detection, but it is not a technical condition required for an XSS payload to execute and steal cookies.

XSS payloads execute as standard JavaScript within the browser's scripting engine; ActiveX is an unrelated, legacy Microsoft technology and is not involved in modern XSS exploitation.