Testing for prototype pollution with DOM Invader - Port Swigger
Summary: PortSwigger describes prototype pollution as a JavaScript vulnerability that lets an attacker add arbitrary properties to global object prototypes, which user-defined objects may then inherit, giving control over properties that would otherwise be inaccessible. Its DOM Invader tool automatically detects client-side prototype pollution sources, scans for gadgets usable in an exploit, and can pollute Object.prototype as a proof of concept, with the process walkable in the DOM XSS via client-side prototype pollution Web Security Academy lab.
Bottom line: Prototype pollution hands an attacker control over object properties that were never meant to be reachable, and DOM Invader's built-in gadget scanning shows how quickly a detected source can be turned into a working exploit.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026