---
id: 5523
title: "Evading CSP with DOM-based dangling markup"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup"
published_at: "2021-07-19T07:19:00Z"
tags: ["browser-security", "xss", "portswigger", "csp-bypass", "dangling-markup", "window-name", "dom-based"]
phying_url: "https://phying.com/item/5523"
lang: en
---

# Evading CSP with DOM-based dangling markup

## Summary

Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2021-07-19T07:19:00Z
- **Original:** https://portswigger.net/research/evading-csp-with-dom-based-dangling-markup
- **Phying News:** https://phying.com/item/5523