Skip to content
What's in a tag name? JavaScript, apparently
portswigger.net | research | #browser-security | #web-security | #xss | #javascript-security | #portswigger | #javascript | #waf-bypass
Summary
PortSwigger's Gareth Heyes shows how unusual HTML tag names can smuggle executable JavaScript: the DOM's lowercase localName property, combined with tabindex/onfocus chains and attribute tricks, yields XSS in every browser and doubles as a WAF bypass; Sol 5.6 contributed further variants.
Why it matters
This research provides technical context that security teams can use for monitoring and validation.
- Published
- Collected