HTML5 web message manipulation (DOM-based)
Summary: PortSwigger describes DOM-based HTML5 web message manipulation as a flaw where a client-side script sends controllable data, such as data from the URL, as a web message to another document in the browser. An attacker can construct a URL that, when visited by another user, causes that user's browser to send a message containing attacker-controlled data, with impact depending on how the receiving document handles it.
Why it matters: The damage lands only if the destination document trusts the sender and handles the message unsafely, so the risk sits in the trust relationship between two documents rather than in either one alone. PortSwigger also notes that static analysis alone can produce false positives, so a finding without dynamic evidence needs code and execution-path review before you treat it as real.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026