Widespread prototype pollution gadgets

Summary: PortSwigger researcher Gareth Heyes documented client-side prototype pollution gadgets in browser APIs and common libraries, including fetch, Object.defineProperty, and localStorage/sessionStorage, where polluted Object.prototype properties can control arguments developers leave unspecified. Heyes traced gadgets such as hitCallback and event_callback to setTimeout sinks in Google Analytics and a sequence gadget to an eval sink in Google Tag Manager, and exploited the Analytics gadget on a well-known game site and a WordPress domain, while Google said shipping code without prototype pollution sources is the customer's responsibility.
Bottom line: Any site running the affected Google Analytics version with a client-side prototype pollution source could have that gadget turned into DOM XSS, and Google's position that fixing gadgets is the customer's job leaves the exposure on your side of the line.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026