Lab: DOM XSS using web messages

Summary: This PortSwigger lab demonstrates a DOM cross-site scripting flaw in which a home page's event listener, intended to serve ads, takes the content of a web message and inserts it into the div with the ID ads. The exploit uses an iframe whose postMessage() call delivers an img tag with an invalid src attribute, and the resulting error fires the onerror handler that executes the payload and calls print().
Key Takeaway: The vulnerable listener accepts web message content without validating its origin or sanitizing it before insertion into the DOM, so any page that can post a message to the target can drive script execution in it.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026