DOM Clobbering

This article first appeared on the HTMLHell Advent Calendar 2022.

Motivation

When thinking of HTML-related security bugs, people often think of script injection attacks, which is also known as Cross-Site Scripting (XSS). If an attacker is able to submit, modify or store content on your web page, they might include …