DOM-based Web Socket-URL poisoning
Summary: PortSwigger describes DOM-based WebSocket-URL poisoning, which occurs when a script uses controllable data as the target URL of a WebSocket connection, letting an attacker construct a URL that makes another user's browser open a WebSocket connection to a server the attacker controls. The impact depends on how the site uses WebSockets: an attacker may capture sensitive data sent from the browser, or subvert the site's logic or deliver client-side attacks if the application processes data read from the WebSocket server.
What you should know: The WebSocket constructor is the named mechanism, and any data from an untrusted source that dynamically sets a connection's target URL is the exposure - meaning a single user who visits an attacker-built link can have their browser stream data to a server outside your control.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026