DOM clobbering named element
form, iframe, img, object with id=location / getElementById / defaultValue so later script reads the element instead of the real API. Inventory it next to innerHTML sinks.
Tags: dom, xss, clobbering
Typical severity: P3-P4
What it becomes
HTML with id/name that shadows a JS global turns a sanitizer or URL check into attacker-controlled data. Often the missing piece in a DOM XSS chain.
Where to look
sanitizer allowlistsURL builders that read locationanalytics callbackswidget bootstraps
Chains
- DOM XSS: Clobbered location or callback is concatenated into a sink the sanitizer thought was safe.
- Prototype pollution gadget: Named properties on window collide with lib defaults.
- CSP bypass lite: Clobber a nonce-bearing script's lookup so a second injection runs.
Notes
- Browser-dependent. Chrome vs Firefox named-property rules differ. Record the engine.
- This is almost never a standalone P1. Attach it to the sink.