The XSS Auditor refused to execute a script in
'http://realfavicongenerator.net/favicon_checker?site=%3Cscript%3Ealert%28%22xss%22%29;%3C/script%3E'
because its source code was found within the request.
The auditor was enabled as the server sent neither an
'X-XSS-Protection' nor 'Content-Security-Policy' header.