[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573769-105":53,"doc-detail-573769-en":125},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":118,"head_meta":120,"extra_data":122,"updated_unix":124},105,"en","in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the-web","In the DOM We Trust - Exploring the Hidden Dangers of Reading from the DOM on the Web","","The DOM tree is a core component of modern web development that enables JavaScript to interact with page structure and content. Although few studies examine its trustworthiness, prior work shows script gadgets can exploit seemingly harmless markup to execute benign JavaScript. This paper demonstrates DOM gadgets broaden the attack surface beyond cross-site scripting. It presents static-dynamic detection and a large crawl of top 15k domains, quantifying vulnerable DOM-to-sink flows, exploit sites, and weak or missing validation.",{"@graph":63,"@context":117},[64,80,100],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the-web/573769/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":94,"encodingFormat":93,"isAccessibleForFree":95,"interactionStatistic":96},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the-web/573769.png","ImageObject",442,249,{"name":88,"@type":89},"Olivia Brown","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-14",true,{"@type":97,"interactionType":98,"userInteractionCount":9},"InteractionCounter",{"@type":99},"ViewAction",{"@type":101,"mainEntity":102},"FAQPage",[103,109,113],{"name":104,"@type":105,"acceptedAnswer":106},"What are DOM gadgets, and how do they differ from script gadgets?","Question",{"text":107,"@type":108},"DOM gadgets are fragments that can be triggered by seemingly benign markup injections. Unlike script gadgets, DOM gadgets do not necessarily produce cross-site scripting, and they can enable other attacks such as request hijacking, CSRF, and UI manipulation.","Answer",{"name":110,"@type":105,"acceptedAnswer":111},"How does the paper detect DOM gadgets?",{"text":112,"@type":108},"It introduces an automated approach that combines static and dynamic analysis. The method traces flows from the DOM to security-sensitive sinks and checks for the presence and effectiveness of validation or sanitization.",{"name":114,"@type":105,"acceptedAnswer":115},"What scale of vulnerable flows does the study report?",{"text":116,"@type":108},"The authors crawl the top 15k domains and identify 2.6 million DOM-to-sink data flows that could lead to DOM gadget exploitation. They also detect 657 DOM gadgets on 37 sites that have the required markup injection vulnerability.","https://schema.org",{"og:url":78,"og:type":119,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":121,"canonical":78},"index,follow",{"doc_id":123,"site_id":56},573769,1792015515,{"code":4,"msg":5,"data":126},{"doc_id":123,"user_id":127,"nickname":88,"user_avatar":128,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":129,"file_id":130,"file_url":131,"file_type":132,"file_size":133,"view_count":9,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":25,"language":134,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":135,"faqs":136,"seo_title":137,"seo_description":61,"update_tm":138,"read_time":47},16904993612988,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","In the DOM We Trust: Exploring the Hidden Dangers of Reading  \nfrom the DOM on the Web  \nJan Drescher∗ Technische Universität Braunschweig Braunschweig, Germany [jan.drescher@tu-braunschweig.de](jan.drescher@tu-braunschweig.de)  \nDavid Klein  \nTechnische Universität Braunschweig Braunschweig, Germany [david.klein@tu-braunschweig.de](david.klein@tu-braunschweig.de)  \nSepehr Mirzaei∗ CISPA Helmholtz Center for Information Security Saarbrücken, Germany [sepehrmirzaei98@gmail.com](sepehrmirzaei98@gmail.com)  \nThomas Barber  \nSAP SE Karlsruhe, Germany [thomas.barber@sap.com](thomas.barber@sap.com)  \nSoheil Khodayari  \nCISPA Helmholtz Center for Information Security Saarbrücken, Germany [shl.khodayari@gmail.com](shl.khodayari@gmail.com)  \nMartin Johns  \nTechnische Universität Braunschweig Braunschweig, Germany [m.johns@tu-braunschweig.de](m.johns@tu-braunschweig.de)  \nGiancarlo Pellegrino  \nCISPA Helmholtz Center for Information Security Saarbrücken, Germany [pellegrino@cispa.de](pellegrino@cispa.de)  \nAbstract  \nThe DOM tree is a central part of modern web development, enabling JavaScript to interact with page content and structure. Only a few prior studies have studied its trustworthiness, despite its widespread use in guiding program logic and security decisions. Most notably, script gadgets have shown how this trust can be exploited by triggering the execution of benign JavaScript fragments with seemingly harmless markup injections. In this paper, we show that script gadgets are only the tip of the iceberg. Seemingly-benign markup injections can trigger the execution of fragments—that we call DOM gadgets—that, unlike script gadgets, do not necessarily result in a cross-site scripting vulnerability. Instead, they can result in a broader set of attacks, such as browser request hijacking attacks, cross-site request forgery attacks, and user interface manipulations.  \nIn this paper, we introduce an automated approach that combines static and dynamic analysis to detect DOM gadgets, tracing flows from the DOM to security-sensitive sinks, and assessing the presence of validation or sanitization checks. We conduct a large-scale web crawl across the top 15k domains and identify 2.6 million DOMto-sink data flows that could lead to DOM gadget exploitation. We complement this by automatically detecting markup injection vulnerabilities, finding 657 DOM gadgets on 37 sites with the markup injection vulnerability required to exploit the DOM gadget. We further analyze these flows to assess the presence and effectiveness of security checks, revealing that 10% of DOM gadget flows receive no validation or sanitization checks. Our results indicate that DOMbased input trust is both widespread and underprotected. Our work  \n∗ Both authors contributed equally to this research.  \nThis work is licensed under a Creative Commons Attribution 4 .0 International License. CCS’25, Taipei, Taiwan  \n© 2025 Copyright held by the owner/author(s) .  \nACM ISBN 979-8-4007-1525-9/2025/10  \n[https://doi.org/10.1145/3719027.3765117](https://doi.org/10.1145/3719027.3765117)  \nhighlights the scale and diversity of DOM gadget vulnerabilities in the wild, motivating a rethink of the DOM’s role in web application trust boundaries and offering tools to aid in their identification and mitigation.  \nCCS Concepts  \n• Security and privacy → Web application security.  \nKeywords  \nDOM; Script Gadgets; Prevalence; DOM Gadgets  \nACM Reference Format:  \nJan Drescher, Sepehr Mirzaei, Soheil Khodayari, David Klein, Thomas Barber, Martin Johns, and Giancarlo Pellegrino. 2025. In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS’25), October 13–17, 2025, Taipei, Taiwan. ACM, New York, NY, USA, 15 pages. [https://doi.org/10.1145/3719027.3765117](https://doi.org/10.1145/3719027.3765117)  \n1 Introduction  \nThe Document Object Model (DOM) [11] is a programming interfa","cbCais4bPvypI7QD","https://ap.wps.com/l/cbCais4bPvypI7QD","pdf",938173,"English","# Abstract\n# Introduction\n## DOM as a Central Web Interface\n## Existing Research on DOM Security Risks\n## DOM Read Implications and Attack Models","[{\"question\":\"What are DOM gadgets, and how do they differ from script gadgets?\",\"answer\":\"DOM gadgets are fragments that can be triggered by seemingly benign markup injections. Unlike script gadgets, DOM gadgets do not necessarily produce cross-site scripting, and they can enable other attacks such as request hijacking, CSRF, and UI manipulation.\"},{\"question\":\"How does the paper detect DOM gadgets?\",\"answer\":\"It introduces an automated approach that combines static and dynamic analysis. The method traces flows from the DOM to security-sensitive sinks and checks for the presence and effectiveness of validation or sanitization.\"},{\"question\":\"What scale of vulnerable flows does the study report?\",\"answer\":\"The authors crawl the top 15k domains and identify 2.6 million DOM-to-sink data flows that could lead to DOM gadget exploitation. They also detect 657 DOM gadgets on 37 sites that have the required markup injection vulnerability.\"}]","In the DOM We Trust - Exploring the Hidden Dangers of Reading from the DOM on the Web | PDF",1791945582]