Evading CSP with DOM-based dangling markup
Summary: PortSwigger researcher Gareth Heyes published a technique in July 2018 that evades Content Security Policy using DOM-based dangling markup, injecting an incomplete base tag target attribute so the page's remaining markup becomes the window name of every link. Because window.name is exposed cross-domain, the attacker only needs the victim to click a link and then reads the window.name property to retrieve data such as CSRF tokens, and Heyes also describes a form-based variant that bypasses XSS Auditor and CSP without the base tag at the cost of two clicks.
What's compelling: A restrictive CSP that blocks all image and sub-resource loads does not stop this attack, so a policy many teams treat as sufficient leaves tokens exposed until a user clicks a single link.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026