Skip to content
Evading CSP with DOM-based dangling markup
portswigger.net | research | #browser-security | #xss | #portswigger | #csp-bypass | #dangling-markup | #window-name | #dom-based
Summary
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
- Published
- Collected