DOM Jungle - Can We Trust The UI?
summary
Claims a concrete defense: an open source project called lavadome encapsulates DOM subtrees to prevent JavaScript from reading secrets (demo: Metamask private key is visible to users but not discoverable by other scripts), implements Shadow DOM plus extra virtualization, and targets read-only protection not full write-blocking. It ships as experimental code, has a live hackable demo, and works against post-load supply‑chain scripts but fails against pre-run scripts or compromised build steps; browser integration remains a goal.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:32XSS attack evolution
- 7:53Supply chain attacks
- 18:56Same-origin policy limits
- 20:19DOM encapsulation risks
- 26:13Metamask client security
- 28:22Introducing Lavadome
- 33:22Lavadome technical approach
- 35:29DOM isolation future
- 38:04Q&A
related talks
30mAchieving the Web Isolation Nirvana - How far along are we?
31mSecuring the DOM from the Bottom Up
36mSecuring the DOM from the Bottom Up
42mDon't trust the DOM: Bypassing XSS mitigations via script gadgets
40mEdgeguard: Client-side DOM Security - detecting malice - An Open Framework
34mDOM XSS Protection at Scale
40mHostile JavaScript: Attacking and Defending the Browser
35mNow you can trust the browser