Bypassing DOMPurify again with mutation XSS

Summary: PortSwigger researcher Gareth Heyes bypassed DOMPurify's patch for Michał Bentkowski's earlier finding by injecting an HTML comment alongside an img tag with a title attribute, encoding the closing comment and a further image carrying an XSS vector. The Chrome vector was disclosed to Cure53 and patched in DOMPurify version 2.1, while a separate Firefox variant using a CDATA tag instead of a normal HTML comment was found after that patch.
Why it matters: The underlying mutation still exists in both Chrome and Firefox even after the sanitizer was fixed, so any HTML filter standing between user input and the browser can be worked around the same way.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026