chat popout XSS minimized