In the DOM We Trust - Exploring the Hidden Dangers of Reading from the DOM on the Web

Oct 14, 2026

The DOM tree is a core component of modern web development that enables JavaScript to interact with page structure and content. Although few studies examine its trustworthiness, prior work shows script gadgets can exploit seemingly harmless markup to execute benign JavaScript. This paper demonstrates DOM gadgets broaden the attack surface beyond cross-site scripting. It presents static-dynamic detection and a large crawl of top 15k domains, quantifying vulnerable DOM-to-sink flows, exploit sites, and weak or missing validation.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages15

Reading Time5 min

AccessFree to download

Abstract

Introduction

DOM as a Central Web Interface

Existing Research on DOM Security Risks

DOM Read Implications and Attack Models

In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web Jan Drescher∗ Technische Universität Braunschweig Braunschweig, Germany [jan.drescher@tu-braunschweig.de](jan.drescher@tu-braunschweig.de) David Klein Technische Universität Braunschweig Braunschweig, Germany [david.klein@tu-braunschweig.de](david.klein@tu-braunschweig.de) Sepehr Mirzaei∗ CISPA Helmholtz Center for Information Security Saarbrücken, Germany [sepehrmirzaei98@gmail.com](sepehrmirzaei98@gmail.com) Thomas Barber SAP SE Karlsruhe, Germany [thomas.barber@sap.com](thomas.barber@sap.com) Soheil Khodayari CISPA Helmholtz Center for Information Security Saarbrücken, Germany [shl.khodayari@gmail.com](shl.khodayari@gmail.com) Martin Johns Technische Universität Braunschweig Braunschweig, Germany [m.johns@tu-braunschweig.de](m.johns@tu-braunschweig.de) Giancarlo Pellegrino CISPA Helmholtz Center for Information Security Saarbrücken, Germany [pellegrino@cispa.de](pellegrino@cispa.de) Abstract The DOM tree is a central part of modern web development, enabling JavaScript to interact with page content and structure. Only a few prior studies have studied its trustworthiness, despite its widespread use in guiding program logic and security decisions. Most notably, script gadgets have shown how this trust can be exploited by triggering the execution of benign JavaScript fragments with seemingly harmless markup injections. In this paper, we show that script gadgets are only the tip of the iceberg. Seemingly-benign markup injections can trigger the execution of fragments—that we call DOM gadgets—that, unlike script gadgets, do not necessarily result in a cross-site scripting vulnerability. Instead, they can result in a broader set of attacks, such as browser request hijacking attacks, cross-site request forgery attacks, and user interface manipulations. In this paper, we introduce an automated approach that combines static and dynamic analysis to detect DOM gadgets, tracing flows from the DOM to security-sensitive sinks, and assessing the presence of validation or sanitization checks. We conduct a large-scale web crawl across the top 15k domains and identify 2.6 million DOMto-sink data flows that could lead to DOM gadget exploitation. We complement this by automatically detecting markup injection vulnerabilities, finding 657 DOM gadgets on 37 sites with the markup injection vulnerability required to exploit the DOM gadget. We further analyze these flows to assess the presence and effectiveness of security checks, revealing that 10% of DOM gadget flows receive no validation or sanitization checks. Our results indicate that DOMbased input trust is both widespread and underprotected. Our work ∗ Both authors contributed equally to this research. This work is licensed under a Creative Commons Attribution 4 .0 International License. CCS’25, Taipei, Taiwan © 2025 Copyright held by the owner/author(s) . ACM ISBN 979-8-4007-1525-9/2025/10 [https://doi.org/10.1145/3719027.3765117](https://doi.org/10.1145/3719027.3765117) highlights the scale and diversity of DOM gadget vulnerabilities in the wild, motivating a rethink of the DOM’s role in web application trust boundaries and offering tools to aid in their identification and mitigation. CCS Concepts • Security and privacy → Web application security. Keywords DOM; Script Gadgets; Prevalence; DOM Gadgets ACM Reference Format: Jan Drescher, Sepehr Mirzaei, Soheil Khodayari, David Klein, Thomas Barber, Martin Johns, and Giancarlo Pellegrino. 2025. In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS’25), October 13–17, 2025, Taipei, Taiwan. ACM, New York, NY, USA, 15 pages. [https://doi.org/10.1145/3719027.3765117](https://doi.org/10.1145/3719027.3765117) 1 Introduction The Document Object Model (DOM) [11] is a programming interfa

FAQs

What are DOM gadgets, and how do they differ from script gadgets?

DOM gadgets are fragments that can be triggered by seemingly benign markup injections. Unlike script gadgets, DOM gadgets do not necessarily produce cross-site scripting, and they can enable other attacks such as request hijacking, CSRF, and UI manipulation.

How does the paper detect DOM gadgets?

It introduces an automated approach that combines static and dynamic analysis. The method traces flows from the DOM to security-sensitive sinks and checks for the presence and effectiveness of validation or sanitization.

What scale of vulnerable flows does the study report?

The authors crawl the top 15k domains and identify 2.6 million DOM-to-sink data flows that could lead to DOM gadget exploitation. They also detect 657 DOM gadgets on 37 sites that have the required markup injection vulnerability.

Oct 14, 2026

Upload by Olivia Brown