Auto Vader
Summary: PortSwigger released AutoVader, a Burp Suite extension by Gareth Heyes that integrates DOM Invader with Playwright to automatically find DOM-based vulnerabilities through context menu actions. The extension launches an automated browser with DOM Invader configured, injects test payloads, and reports findings as Scanner issues; version 1.0.11 was last updated 11 December 2025.
What you should know: DOM-based vulnerabilities that only surface through context menu interactions are easy to miss in manual testing, and this tool turns that gap into automated Scanner findings - but it is third-party code that PortSwigger explicitly makes no warranty about, so a security leader should weigh the coverage gain against running an unwarranted extension in their testing pipeline.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026