Testing for client-side prototype pollution - Port Swigger
Summary: PortSwigger's DOM Invader tool now detects client-side prototype pollution sources in the URL and in JSON objects sent via web messages, and can generate a proof of concept by adding an arbitrary property to Object.prototype for manual verification in the browser console. It also scans for gadget properties passed to sinks without sanitization, and can combine source, gadget, and sink to confirm XSS by calling alert(); the features are disabled by default and must be toggled on under Attack types.
What you should know: A prototype pollution source is only exploitable when paired with a gadget that reaches a sink unsanitized, and DOM Invader's automated gadget scan turns what the source calls an extremely tedious manual hunt into a button click - meaning the same XSS path is now easier for attackers to find than for defenders to rule out.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026