Lab: Exploiting DOM clobbering to enable XSS
Summary: PortSwigger's lab demonstrates a DOM-clobbering flaw in a blog comment feature that permits "safe" HTML: two anchor tags sharing an ID form a DOM collection, and the name attribute on the second anchor clobbers the avatar property with its href value. The site's DOMPurify filter allows the cid: protocol, which does not URL-encode double-quotes, so an encoded quote is decoded at runtime and the defaultAvatar variable is assigned {avatar: 'cid:"onerror=alert(1)//'}, triggering alert() when a second comment is posted; the intended solution works only in Chrome.
Bottom line: The sanitizer was present and still lost: DOMPurify permitted a protocol that let an encoded double-quote survive to runtime, so the control in place did not stop the payload. The exploit also required no script injection into the comment itself, only HTML the feature was designed to accept.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026