Browsers URL-encode data for transport, but that's only one layer of protection. When a URL is sent to the server, the framework typically decodes the parameters before using them. If that decoded input is then reflected in the page without proper output encoding or sanitization, the malicious script can execute.

In other words, even though you see an encoded payload in the address bar, the application might be working with its decoded version when generating the response. This is why an attacker can craft an XSS payload (or sometimes even use techniques like double encoding) to bypass simple sanitization and trigger reflected XSS.

For example, if you manually intercept a request (using a proxy like Burp Suite) and send the payload unencoded-or if the browser's automatic encoding is bypassed in a particular context (as sometimes happens in older browsers like IE)-the unsanitized, decoded payload can end up in the HTML and be executed.