Which of the following is a type of vulnerability that involves inserting scripts into web-based applications in order to take control of the client's web browser?

Cross-site scripting (XSS) is a vulnerability where attackers inject malicious scripts, typically JavaScript, into legitimate web pages. When a user visits the compromised page, their browser executes the script, allowing the attacker to steal cookies, session tokens, or deface the website. SQL injection targets databases by inserting malicious SQL queries into input fields, not client browsers. A zero-day exploit is a vulnerability unknown to the vendor, not a specific attack type. An on-path attack (formerly man-in-the-middle) intercepts communication between two parties, which is different from injecting scripts into a web application.