Everything You Wanted to Know About DOM Clobbering (But Were...
summary
Presents concrete results: an automated static+dynamic detector (available at joe.me) and a markup generator (domcloud.xyz) that exhaustively tests clobbering patterns across 19 browsers, producing 31.4K markups from ~24–25 million cases. Finds 9.8% of top 5K sites affected: 9,400+ global data flows, 491 vulnerable sites, 44 confirmed-and-patched exploits (GitHub, Trello, Fandom). Shows browser inconsistency, 10 behavioral groups, and that CSPs miss ~80–85% of cases while object freezing and sanitizers also leave gaps. Recommends namespace isolation and developer patterns to prevent clobbering.
AI-written summary · about
chapters (11)
- 0:00DOM clobbering introduction
- 3:12DOM clobbering enables code execution
- 7:51Why DOM clobbering occurs
- 11:06Research on DOM clobbering
- 16:28Automating DOM clobbering markups
- 18:56Browser inconsistencies in DOM clobbering
- 20:21Detecting DOM clobbering at scale
- 22:50Real-world impact and examples
- 25:43Evaluating defenses against DOM clobbering
- 31:47Fixes and developer guidelines
- 34:11Key takeaways
related talks
40mClient-Side Protection Against DOM-Base...
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
23mJavaScript attack surface
42mDon't trust the DOM: Bypassing XSS mitigations via script gadgets
42mEverything you need to know about client-side malicious code execution
34mDOM XSS Protection at Scale
29mFinding and Fixing DOM-based XSS - with Static Analysis
40mHostile JavaScript: Attacking and Defending the Browser