HTML5 web message manipulation (stored DOM-based)
Summary: Stored DOM-based HTML5 web message manipulation occurs when user input is stored and later embedded into a response in a part of the DOM that a client-side script processes unsafely, and a script then sends that controllable data as a web message to another document in the browser. PortSwigger notes that impact depends on how the destination document handles the incoming message, and that Burp Scanner flags the issue through dynamic and static analysis, where static analysis alone can produce false positives.
Bottom line: The exploit only works if the receiving document trusts the sender and handles the message unsafely, so the trust relationship between two documents in your own application is the actual attack surface. Burp's own caveat that static analysis can flag issues that are not exploitable means a scanner finding here needs code and execution-path review before you treat it as real.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026