DOM-Based XSS.

DOM-based XSS (Type-0) is a cross-site scripting flaw whose root cause lives entirely in client-side code. The term was coined by Amit Klein in 2005 in the paper "DOM Based Cross Site Scripting or XSS of the Third Kind." A trusted source — location.hash, location.search, document.referrer, window.name, postMessage, or localStorage — flows without sanitization into a dangerous sink such as innerHTML, document.write, eval, setTimeout, or jQuery.html(). Because the malicious payload often rides in the URL fragment (after #), it is never sent to the server, making the flaw invisible to WAFs, server logs, and most reflected-XSS scanners.

Real-world impact is large: DOM XSS has repeatedly surfaced in ad and analytics tags, in postMessage handlers that trust cross-origin data, and in legacy jQuery selectors ($(location.hash), patched in CVE-2011-4969 for versions before 1.6.3). Google's own analysis found the majority of XSS in its products was DOM-based, motivating the creation of Trusted Types. Defences: prefer inert sinks like textContent and setAttribute; sanitize with DOMPurify or the built-in Sanitizer API; enforce Trusted Types plus a strict Content Security Policy; and run taint-tracking tools that trace source-to-sink flows during code review.

flowchart LR
  A["Source<br/>location.hash / postMessage"] --> B[Client-side JS<br/>reads value]
  B --> C{Sanitized?}
  C -->|"textContent / DOMPurify"| D[Rendered safely]
  C -->|"raw string to innerHTML,<br/>eval, document.write"| E[Sink executes payload]
  E --> F[Attacker script runs<br/>in victim's session]
  F --> G[Cookie theft, account<br/>takeover, keylogging]
  E -.->|Trusted Types blocks| H[TypeError, no execution]