DOM clobbering is a browser behavior that can become a security vulnerability when named HTML elements collide with properties that JavaScript expects to find on objects such as window or document. The browser may return an element or collection where an application expects configuration or another value. It does not automatically reassign every JavaScript variable: risk arises when untrusted markup creates a collision and existing code trusts the result.
How can an HTML element affect a JavaScript lookup?
Browsers expose certain elements through named properties, often based on an element’s id or name. As a result, code that reads a property such as window.redirectTo can receive a reference to a matching element instead of the application value it expected. The precise result depends on the browser’s named-property behavior and the markup involved.
This is not the same as changing a local variable declared with let or const. The vulnerable pattern is a lookup through a clobberable browser object, followed by code that assumes the returned value has a particular meaning or type.
When does DOM clobbering become a vulnerability?
Clobbering matters when an attacker can influence HTML that reaches the DOM and application code makes an unsafe property lookup. The markup need not contain a script: the technique can remain relevant even when a filter or sanitizer blocks direct script injection but allows attacker-controlled names or attributes.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- A collision: An element’s name matches a property the code reads.
- Unsafe use: The application treats the resulting element or collection as trusted configuration, a URL, or another expected value.
- A useful impact: The altered value affects a sensitive operation, such as navigation, script loading, or filtering.
Without an exploitable collision and a vulnerable use of the value, the presence of an element with a particular name is not, by itself, proof of a security issue.
What can an attacker influence?
Navigation and configuration
OWASP describes code that uses window.redirectTo || '/profile/' as a navigation destination. If attacker-controlled markup creates a matching named property, the lookup may yield an element whose URL-related value can influence navigation. OWASP also describes a clobbered configuration property affecting a dynamically created script URL. These examples show why code should not treat a browser-global property as trusted configuration simply because it exists.
Rank #2
Collections and script URLs
PortSwigger demonstrates how repeated anchor IDs can produce a collection, and how a named child property of that collection can be used as a script URL by vulnerable code. The important lesson is the unexpected shape of the returned value: code may receive a collection or element where it assumes it has a safe configuration object.
Filtering logic
PortSwigger also documents a form-based case in which an injected input named attributes interferes with code that expects a form’s attributes collection while filtering markup. This shows that DOM properties used in security-sensitive filtering need validation too; a property name alone does not guarantee the expected interface or behavior.
What can DOM clobbering lead to?
The impact depends on the vulnerable data flow. It may cause unexpected behavior or redirects; in some cases, it can help reach script execution by influencing a script URL or another security-sensitive operation. DOM clobbering does not automatically mean that a page has cross-site scripting (XSS), and the cited sources do not establish a prevalence figure that would justify a numerical estimate.
How should developers prevent it?
Sanitize untrusted HTML at the boundary
Sanitize HTML before inserting it into the DOM. OWASP recommends DOMPurify or the Sanitizer API. DOMPurify’s default SANITIZE_DOM setting addresses collisions with built-in APIs and properties. OWASP also notes that setting SANITIZE_NAMED_PROPS: true isolates custom names by prefixing them with user-content-. That stronger namespacing can affect features that rely on the original IDs or names, so choose the setting with the application’s legitimate markup needs in mind.
Rank #4
If using the Sanitizer API, configure it to block id and name attributes where that fits the feature. OWASP cautions that the API’s default configuration does not itself prevent DOM clobbering. Confirm support in the browsers your application targets before depending on it; a current compatibility matrix is not established by the cited guidance.
Keep sensitive state out of named globals
Store configuration in local lexical variables or encapsulated application state rather than relying on names exposed through window or document. Explicit let and const declarations help avoid accidental globals, but they do not protect a separate property such as window.NAME if code still reads from it.
Recommended Free Tools
Validate values at the point of use
Before using values from window, document, or DOM properties in sensitive operations, check that they have the expected type and behavior. PortSwigger gives checking for an expected DOM interface as an example. Apply validation to the actual operation: a value used as a URL, a configuration object, or a filtering collection should meet the relevant expectations before the code trusts it.
Use CSP as an additional layer
A Content Security Policy (CSP) can restrict some attempts to load new scripts, but it does not repair unsafe use of values by code that is already running. Treat CSP as defense in depth, alongside sanitization, safer state management, and validation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which defense belongs at which layer?
| Defense | Where it acts | What it helps address | Important limitation |
|---|---|---|---|
| HTML sanitization | When untrusted markup enters the application | Removes or isolates hostile markup and names; DOMPurify can address DOM clobbering, with SANITIZE_NAMED_PROPS: true available for custom-name isolation |
Sanitizer configuration can affect legitimate uses of id and name; the Sanitizer API’s default configuration does not itself prevent clobbering |
| Safer scoping and explicit state | Application code | Reduces reliance on clobberable window or document names |
Does not secure a separate named property that code continues to read |
| Type and interface validation | At sensitive use sites | Catches an unexpected element or collection before the application treats it as another kind of value | Must match the operation and expected value; it does not remove hostile markup |
| CSP | Browser enforcement of script-loading and execution rules | Can limit some attacks that attempt to load a new script | Does not prevent every misuse of values by code that is already running |
No one measure covers every vulnerable use. A robust design sanitizes untrusted HTML, avoids security-sensitive named globals, and validates values before acting on them; CSP can provide an additional restriction on certain execution paths.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
