DOM-Based XSS.

An XSS variant where the injection and execution happen entirely in the browser as client-side JavaScript writes untrusted data into a sink without sanitization. It belongs to the Attacks & Threats category of cybersecurity.

An XSS variant where the injection and execution happen entirely in the browser as client-side JavaScript writes untrusted data into a sink without sanitization.

DOM-based XSS (also called Type-0) is a cross-site scripting flaw whose root cause lives entirely in client-side code. A trusted source — for example location.hash, document.referrer, window.name, postMessage, or localStorage — is passed without sanitization into a dangerous DOM sink such as innerHTML, document.write, eval, or jQuery.html. The server never sees the payload, which makes the vulnerability invisible to traditional WAFs and server logs. Defenses include using safe APIs like textContent, leveraging Trusted Types in modern browsers, deploying a strict Content Security Policy, and auditing JavaScript with tools that track tainted-data flow from sources to sinks.

Defences for DOM-Based XSS typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Type-0 XSS, Client-side XSS.