Document domain manipulation (DOM-based)
Summary: DOM-based document domain manipulation occurs when a client-side script sets the document.domain property using controllable data, such as the URL, letting an attacker construct a link that makes a target page set an arbitrary document.domain value. Because browsers let pages from different origins interact freely once they share a document.domain value, an attacker who gets a target page and a page they control to set the same value can compromise the target page with the same exploitation possibilities as cross-site XSS.
What you should know: Browsers restrict which values can be assigned, but they allow child and parent domains, so an attacker may be able to shift a target page onto a related application with a weaker security posture - and some browser quirks permit switching to completely unrelated domains, putting the severity not far behind regular XSS.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026