Skip to content
Finding DOM Polyglot XSS in PayPal the Easy Way
portswigger.net | research | #bug-bounty | #dom-invader | #dom-xss | #csp-bypass | #paypal | #script-gadgets
Summary
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
- Published
- Collected