HTML5 storage manipulation (DOM-based)
Summary: PortSwigger describes HTML5 storage manipulation as a DOM-based issue where a client-side script stores controllable data, such as data from the URL, in the browser's localStorage or sessionStorage. The storage itself is not a vulnerability, but if the application later reads that data back and processes it unsafely, an attacker can use it to deliver other DOM-based attacks such as cross-site scripting and JavaScript injection.
Key Takeaway: Burp Suite flags this through static and dynamic analysis, and PortSwigger notes static analysis alone can produce false positives that are not actually exploitable, so a finding without dynamic evidence has to be checked against the code and execution paths. The stated fix is to keep any data from an untrusted source out of HTML5 storage entirely.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026