I think `X-XSS-Protection: 1; mode=block` is enabled by default in Chrome for all sites. I remember sending a malicious payload to one of my own pages and having the entire page blocked by Chrome (but not by Firefox).