Java Script without parentheses using DOMMatrix
Summary: PortSwigger researcher Gareth Heyes found that the DOMMatrix constructor can generate parentheses in JavaScript, allowing function calls on sites that block the () characters in a limited-charset XSS scenario. He used the constructor's toString output, which resembles a call to a function named matrix with arguments 1,0,0,1,0,0, and controlled the function and first argument via the matrix variable and the object's "a" property to call alert(1337).
What's compelling: A character blacklist that blocks parentheses is not a control: a built-in browser constructor already produces them, so any WAF or input filter relying on charset restriction can be routed around by an attacker who knows the gadget.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026