Top 10 winner

Permanent backdooring of HTML5 client-side application

How a Platform Using HTML5 Can Affect the Security of Your Website

Joey Tyson · Security Musings · 1 February 2012

Caching application JavaScript in HTML5 localStorage turns any reflected XSS on the caching origin into a persistent, self-reloading compromise. The article documents a real case: the Apture widget cached 272KB of code and eval'd it, and a reflected XSS on cdn.apture.com let an attacker poison that cache. The payload then executed on every third-party site embedding Apture.

Record

Document

How a Platform Using HTML5 Can Affect the Security of Your Website

Researcher

Joey Tyson

Published by

Security Musings

Date

1 February 2012

Topic

Browser

In the archive

• Ranked #7 in the 2012 Top 10 Web Hacking Techniques

Related sources

• Artur Janc on persistent client-side attacks
• The Emperor’s New APIs Whitepaper

Tags

• xss
• javascript
• cache
• supply-chain
• case-study
• dom
• owasp-a03-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Joey Tyson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.