HTML5 web message manipulation (reflected DOM-based)
Summary: PortSwigger describes reflected DOM-based HTML5 web message manipulation as a flaw where data copied from a request is echoed into the immediate response in a part of the DOM processed unsafely by a client-side script, and a script sends controllable data as a web message to another document in the browser. An attacker can construct a URL that, when visited by another user, causes that user's browser to send a web message containing attacker-controlled data, with impact depending on how the destination document handles the incoming message.
What you should know: The damage lands only if the receiving document trusts the sender and handles the message unsafely, so the joint behavior of two documents can compromise the user even when neither looks broken alone. PortSwigger also notes its static analysis can flag false positives that are not actually exploitable, so a finding without dynamic evidence needs code and execution-path review before you act on it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026