Denial of service (DOM-based)
Summary: DOM-based denial of service occurs when a client-side script passes controllable data, such as data from the URL, to a problematic platform API in an unsafe way. An attacker can construct a URL that, when visited by another user, causes that user's computer to consume excessive CPU or disk space, potentially leading the browser to reject localStorage writes or kill busy scripts.
Bottom line: The attack rides in a URL and lands on the end user's machine, not your servers, so the symptom a security leader sees is a browser or device degrading rather than a service outage. PortSwigger notes its own scanner's static analysis can flag false positives, so confirming exploitability requires reviewing the code and execution paths.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026