vulns.co
/
mcp by GKData.io

Back to Gadgets

DOM clobbering named element

form, iframe, img, object with id=location / getElementById / defaultValue so later script reads the element instead of the real API. Inventory it next to innerHTML sinks.

Tags: dom, xss, clobbering

Typical severity: P3-P4

What it becomes

HTML with id/name that shadows a JS global turns a sanitizer or URL check into attacker-controlled data. Often the missing piece in a DOM XSS chain.

Where to look

  • sanitizer allowlists
  • URL builders that read location
  • analytics callbacks
  • widget bootstraps

Chains

  • DOM XSS: Clobbered location or callback is concatenated into a sink the sanitizer thought was safe.
  • Prototype pollution gadget: Named properties on window collide with lib defaults.
  • CSP bypass lite: Clobber a nonce-bearing script's lookup so a second injection runs.

Notes

  • Browser-dependent. Chrome vs Firefox named-property rules differ. Record the engine.
  • This is almost never a standalone P1. Attach it to the sink.

Back to Gadgets