Client-side trust and executable content
Disclosures that turn uploads, messages, markup, or browser-side state into execution under a trusted origin.
Pattern collection. This is original synthesis across public, source-verified disclosures; severity labels remain exactly as reported by each source.
Field lens
Trace attacker-controlled data from its source through each transformation to the final browser sink. A useful disclosure proves both reachability and the security context in which execution occurs.
Evidence that changes the decision
- Untrusted content is served with an executable type or inserted into an executable DOM context.
- A cross-window message reaches a sensitive sink without a strict origin and schema check.
- The proof records the affected origin and privilege context without collecting victim data.
Control themes
- Encode for the exact output context and avoid dangerous DOM sinks.
- Isolate user-controlled files on a separate origin and force safe content types.
- Validate message origin, source window, and payload schema before acting.