---
id: 6730
title: "What's in a tag name? JavaScript, apparently"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently"
published_at: "2026-08-25T14:24:00Z"
tags: ["browser-security", "web-security", "xss", "javascript-security", "portswigger", "javascript", "waf-bypass"]
phying_url: "https://phying.com/item/6730"
lang: en
---

# What's in a tag name? JavaScript, apparently

## Summary

PortSwigger's Gareth Heyes shows how unusual HTML tag names can smuggle executable JavaScript: the DOM's lowercase localName property, combined with tabindex/onfocus chains and attribute tricks, yields XSS in every browser and doubles as a WAF bypass; Sol 5.6 contributed further variants.

## Why it matters

This research provides technical context that security teams can use for monitoring and validation.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2026-08-25T14:24:00Z
- **Original:** https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently
- **Phying News:** https://phying.com/item/6730