DOM-based HTML5-storage manipulation
Summary: PortSwigger Research describes DOM-based HTML5-storage manipulation, where a script stores attacker-controllable data in the browser's localStorage or sessionStorage, letting an attacker build a URL that makes another user's browser store that data. The storage itself is not a vulnerability, but if the application later reads the data back and processes it unsafely, an attacker can use it to deliver other DOM-based attacks such as cross-site scripting and JavaScript injection.
What's compelling: The payload sits in the victim's own browser storage rather than in the URL or response, so it can persist after the original link is gone and resurface wherever the application reads that data back.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026