---
id: 5488
title: "Bypassing DOMPurify again with mutation XSS"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-dompurify-again-with-mutation-xss"
published_at: "2020-10-07T15:02:00Z"
tags: ["firefox", "web-security", "chrome", "dompurify", "mutation-xss", "sanitizer-bypass"]
phying_url: "https://phying.com/item/5488"
lang: en
---

# Bypassing DOMPurify again with mutation XSS

## Summary

A fresh mutation XSS bypass of DOMPurify's patch: crafted comments and encoded tags mutate sanitized markup into executable XSS in Chrome, plus a CDATA variant for Firefox; fixed in DOMPurify 2.1.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-10-07T15:02:00Z
- **Original:** https://portswigger.net/research/bypassing-dompurify-again-with-mutation-xss
- **Phying News:** https://phying.com/item/5488