#FactCheck -Doctored Images of Trump–Xi and Biden–Xi Meetings Go Viral; Fact Check Finds No Evidence of Claims

Introduction

Web applications are essential in various sectors, including online shopping, social networks, banking, and healthcare systems. However, they also pose numerous security threats, including Cross-Site Scripting (XSS), a client-side code injection vulnerability. XSS attacks exploit the trust relationship between users and websites, allowing them to change web content, steal private information, hijack sessions, and gain full control of user accounts without breaking into the core server. This vulnerability is part of the OWASP Top 10 Web Application Security Risks.

‍

What is Cross-Site Scripting (XSS)?

An XSS attack occurs when an attacker injects client-side scripts into web pages viewed by other users. When users visit the affected pages, their browsers naively execute the inserted scripts. The exploit takes advantage of web applications that allow users to submit content without properly sanitising inputs or encoding outputs. These scripts can cause a wide range of damage, including but not limited to stealing session cookies for session hijacking, redirecting users to malicious sites, logging keystrokes to capture credentials, and altering the DOM to display fake or phishing content.

‍

How Does XSS Work?

1. Injection: A malicious user submits code through a website input, like a comment or form.
2. Execution: The submitted code runs automatically in the browsers of other users who view the page.
3. Exploitation:The attacker can steal session information, capture credentials, redirect users, or modify the page content.

The fundamental cause behind the XSS vulnerabilities is the application of:

• Accepting trusted input from the users.  
• After users' input, web pages have the strings embedded without any sanitisation.  
• Not abiding by security policies like Content Security Policy (CSP).  

With such vulnerabilities, attackers can generate malicious payloads like:  <script>alert('XSS');</script>  

‍

This code might seem simple, but its execution provides the attacker with the possibility to do the following:  

• Copy session tokens through hidden HTTP requests.  
• From attacker-controlled domains, load attacker scripts.  
• Change the DOM structure to show fake login forms for phishing.

‍

Types of XSS Attacks: XSS (Cross-Site Scripting) attacks can occur in three main variations: 

1. Stored XSS: This type of attack occurs when an attacker injects an administered payload into the database or a message board. The script then runs whenever a user visits the affected board.
2. Reflected XSS: In this attack, the danger lies in a parameter of the URL. Its social engineering techniques are attacks, in which it requires tricking people to click on a specially designed link. For example:
3. DOM-Based XSS: This technique injects anything harmful without the need for server-side scripts, in contrast to other approaches. It targets JavaScript client-side scripts such as `document.write` and `innerHTML`. Without carrying out any safety checks, these scripts will alter the page's look (DOM stands for Document Object Model). If the hash is given a malicious string, it is run directly within the browser.

‍

What Makes XSS a Threat?  

‍

A Cross-Site Scripting attack is only a primary attack vector, and can lead to significant damage that includes the following: 

• Statement Hijacking. This uses scripts to steal cookies, which are then used to pose as authorized users.  
• Theft of Credentials. Users’ passwords and usernames are wrenched from keystroke trackers.  
• Phishing. Users are prompted with deceitful login forms that are used to capture sensitive details.  
• Website Vandalism. Modified website material lowers the esteem of the brand.  
• Monetary and Legal Consequences. There are compounding effects to GDPR and DPDP Act compliance in case of Data breaches, which incur penalties and fines.  ‍

‍

Incidents in the Real World  

In 2021, an XSS Stored attack occurred on a famous e-commerce platform eBay, through their product review system. The malicious JavaScript code was set to trigger every time an infected product page was accessed by customers. This caused a lot of problems, including account takeovers, unauthorised purchases, and damage to the company’s reputation. This example further worsens the fact that even reputed platforms can be targeted by XSS attacks.

‍‍

How to Prevent XSS?

Addressing XSS vulnerabilities demands attention to detail and coordinated efforts across functions, as illustrated in the steps below:

 Input Validation and Output Encoding:

• Ensure input validation is in place on the client and server.
• Perform output encoding relative to context: HTML: <, >, &.
• JavaScript: Escape quotes and slashes

Content Security Policy (CSP): CSP allows scripts to be executed only from the verified sources, which helps diminish the odds of harmful scripts running on your website. For example, the Header in the code could look to some degree like this: Content-Security-Policy: script-src 'self';

Unsafe APIs should be dodged: Avoid the use of document.write(), innerHTML, and eval(), and make sure to use:

• TextContent for inserting text.
• CreateElement() and other DOM creation methods for structured content.

Secure Cookies: Apply the HttpOnly and Secure cookie flags to block JavaScript access. 

Framework Protections: Use the protective features in frameworks such as:

• React, which escapes data embedded in JSX automatically.
• Angular, which uses context-aware sanitisation.

Periodic Security Assessment:

• Use DAST tools to test the security posture of an application.
• Perform thorough penetration testing and security-oriented code reviews.

‍

‍Best Practices for Developers: Assume a Secure Development Lifecycle (SDLC) integrating XSS stoppage at each point.

• Educate developers on OWASP secure coding guidelines.
• Automate scanning for vulnerabilities in CI/CD pipelines.

‍

‍Conclusion:

To reduce the potential danger of XSS, both developers and companies must be diligent in their safety initiatives, ranging from using Content Security Policies (CSP) to verifying user input. Web applications can shield consumers and the company from the subtle but long-lasting threat of Cross-Site Scripting if security controls are implemented during the web application development stage and regular vulnerability scans are conducted.

‍

References

• https://owasp.org/www-community/attacks/xss/
• https://www.paloaltonetworks.com/cyberpedia/xss-cross-site-scripting
• https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting
• https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

‍

‍

Executive Summary 

‍

A video circulating on social media shows Uttar Pradesh Chief Minister Yogi Adityanath and Gorakhpur MP Ravi Kishan walking with a group of people. Users are claiming that the two leaders were participating in a protest against the University Grants Commission (UGC). Research by CyberPeace has found the viral claim to be misleading. Our research  revealed that the video is from September 2025 and is being shared out of context with recent events. The video was recorded when Chief Minister Yogi Adityanath undertook a foot march in Gorakhpur on a Monday. Ravi Kishan, MP from Gorakhpur, was also present. During the march, the Chief Minister visited local markets, malls, and shops, interacting with traders and gathering information on the implementation of GST rate cuts.

‍

Claim Details:

‍

On Instagram, a user shared the viral video on 27 January 2026. The video shows the Chief Minister and the MP walking with a group of people. The text “UGC protest” appears on the video, suggesting that it is connected to a protest against the University Grants Commission.

• https://www.instagram.com/reel/DT_r37Skh74/?igsh=MXM3bWNwbjZhZTJ5bg%3D%3D 
• https://archive.ph/QxvVs 

‍

‍

Fact Check:

‍

To verify the claim, we searched Google using relevant keywords, but found no credible media reports confirming it.Next, we extracted key frames from the video and searched them using Google Lens. The video was traced to NBT Uttar Pradesh’s X (formerly Twitter) account, posted on 22 September 2025.

• https://x.com/UPNBT/status/1970084416316924337?s=20 

‍

‍

According to NBT Uttar Pradesh, CM Yogi Adityanath undertook a foot march in Gorakhpur, visiting malls and shops to interact with traders and check the implementation of GST rate cuts.

‍

Conclusion:

‍

The viral video is not related to any recent UGC guidelines. It dates back to September 2025, showing CM Yogi Adityanath and MP Ravi Kishan on a foot march in Gorakhpur, interacting with traders about GST rate cuts.The claim that the video depicts a protest against the University Grants Commission is therefore false and misleading.

‍

Introduction

Monopolies in any sector can have a great impact on economic efficiency and, by extension, on the market and the larger economy. Data monopolies hurt both small startups and large, established companies, and it is typically the biggest corporate players who have the biggest data advantage. Google has recently lost a major antitrust case filed by the U.S. Department of Justice, which focused on the company's search engine dominance and expensive partnerships to promote its products. The lawsuit accused Google of using its dominant position in the search engine market to maintain a monopoly. The case has had a significant impact on consumers and the tech industry as a whole. This dominance allowed Google to raise prices on advertisers without consequences, and delay innovations and privacy features that consumers want when they search online.

Antitrust Allegations Against Google in the US and EU

In the case filed by the US Department of Justice, US District Judge Amit Mehta ruled that Google was monopolistic. In the 10-week-long trial, Google lost the major antitrust lawsuit, and it was established that the tech giant had a monopoly in the web search and advertising sectors. The lawsuit accused Google of using its dominant position in the search engine market to elbow out rivals and maintain a monopoly. The tech giant’s exclusive deals with handset makers were brought before the court as evidence. Additionally, the European Commission has fined Google €1.49 billion for breaching EU antitrust rules in 2019.

The Impact of Big Tech Monopolies on the Digital Ecosystem and Beyond 

• Big-tech companies collect vast amounts of personal data, raising concerns about how this data is used and protected. The concentration of data in the hands of a few companies can lead to privacy breaches and misuse of personal information.
• The dominance of a few tech giants in digital advertising markets can stifle competition, leading to higher prices for advertisers and fewer choices for consumers. This concentration also allows these companies to exert major control over what ads are shown and to whom.
• Big-tech platforms have substantial power over the dissemination of information. Their algorithms and policies on content moderation can influence public discourse and may spread misinformation. The lack of competition means fewer alternatives are accessible for users seeking different content moderation policies. In 2021 Google paid $26.3 billion to ensure its search engine is the default on smartphones and browsers and to keep control of its dominant market share.

Regulatory Mechanisms in the Indian Context

In India, antitrust issues are governed by the Competition Act of 2002 and the Competition Commission of India (CCI) checks monopolistic practices. In 2022, the CCI imposed a penalty of Rs 1,337.76 crore on Google for abusing its dominant position in multiple markets for 'anti-competitive practices' in the Android mobile device ecosystem. The Draft Digital Competition Bill, 2024, has been proposed as a legislative reform to regulate a wide range of digital services, including online search engines, social networking platforms, video-sharing sites, interpersonal communication services, operating systems, web browsers, cloud services, advertising services, and online intermediation services. The bill aims to promote competition and fairness in the digital market by addressing anti-competitive practices and dominant position abuses in the digital business space.

Conclusion

Big-tech companies are increasingly under scrutiny from regulators due to concerns over their monopolistic practices, data privacy issues, and the immense influence on markets and public discourse. The U.S. Department of Justice's victory against Google and the European Commission's hefty fines are indicators of a global paradigm shift towards more aggressive regulation to foster competition and protect consumer interests. The combined efforts of regulators across different jurisdictions underscore the recognition that monopolistic practices by such big tech giants can stifle innovation, harm consumers’ interests, and create barriers for new entrants, thus necessitating strong legal frameworks to ensure fair and contestable markets. Overall, the increasing regulatory pressure signifies a pivotal moment for big-tech companies, as they face the challenge of adapting to a more tightly controlled environment where their market dominance and business practices are under intense examination.

References

• https://www.livemint.com/technology/tech-news/googles-future-siege-u-s-court-explores-breaking-up-company-after-landmark-ruling-11723648047735.html
• https://www.thehindu.com/sci-tech/technology/what-is-the-google-monopoly-antitrust-case-and-how-does-it-affect-consumers/article68495551.ece 
• https://indianexpress.com/article/business/google-has-an-illegal-monopoly-on-search-us-judge-finds-9497318/

‍