DOM-based document-domain manipulation
Summary: PortSwigger Research describes DOM-based document-domain manipulation, which occurs when a script uses attacker-controllable data to set the document.domain property, letting an attacker construct a URL that causes a response page to set an arbitrary document.domain value. Because browsers use document.domain to enforce the same origin policy, two pages that set the same value can interact without restriction, and browsers allow child or parent domains plus some quirks that permit switching to unrelated domains.
What's compelling: An attacker who gets a target page and a page they control to share a document.domain value can fully compromise the target page, with exploitation possibilities close to regular XSS. The browser allowances for parent and child domains mean the pivot can land on a related site with a weaker security posture.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026