XSS in IE - Way to bypass?

Question

Since IE 8 has an XSS filter, is there really no way to exploit an XSS exploit using this browser? For example, a cookie stealer isn't a threat to my site anymore?

(If you think this is not correct and you have a possible flaw in the filter, I'd like to know)

Answer 1

The XSS-Filter in IE8 can sure be beaten. It depends on the XSS-Vuln in the page whether it's possible or not. For example you can use weird encodings or a double XSS attack. Edit: This is an in-the-wild example of an XSS-Attack that would pass the IE8-Filter: XSS on esrb.org