What's in a tag name? JavaScript, apparently
portswigger.net | research | #browser-security | #web-security | #xss | #javascript-security | #portswigger | #javascript | #waf-bypass
Summary
PortSwigger's Gareth Heyes shows how unusual HTML tag names can smuggle executable JavaScript: the DOM's lowercase localName property, combined with tabindex/onfocus chains and attribute tricks, yields XSS in every browser and doubles as a WAF bypass; Sol 5.6 contributed further variants.
Why it matters
This research provides technical context that security teams can use for monitoring and validation.
- Published
- Collected
--- id: 6730 title: "What's in a tag name? JavaScript, apparently" source_domain: portswigger.net source_url: "https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently" published_at: "2026-08-25T14:24:00Z" tags: ["browser-security", "web-security", "xss", "javascript-security", "portswigger", "javascript", "waf-bypass"] phying_url: "https://phying.com/item/6730" lang: en --- # What's in a tag name? JavaScript, apparently ## Summary PortSwigger's Gareth Heyes shows how unusual HTML tag names can smuggle executable JavaScript: the DOM's lowercase localName property, combined with tabindex/onfocus chains and attribute tricks, yields XSS in every browser and doubles as a WAF bypass; Sol 5.6 contributed further variants. ## Why it matters This research provides technical context that security teams can use for monitoring and validation. ## Intelligence Metadata - **Sources:** portswigger.net - **Published:** 2026-08-25T14:24:00Z - **Original:** https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently - **Phying News:** https://phying.com/item/6730