Collected research

Evading CSP with DOM-based dangling markup

Gareth Heyes · PortSwigger Research · 18 July 2018

Dangling markup normally dies under a strict CSP because no external resource may load. Injecting an unterminated base target attribute, or a form target, instead captures the following page markup into window.name, so a single victim click hands CSRF tokens and other secrets to an attacker page even under default-src 'none'.

Record

Researcher

Gareth Heyes

Published by

PortSwigger Research

Date

18 July 2018

Topic

XSS

In the archive

• Collected in the 2018 research round

Related sources

• DOM-based dangling markup proof of concept 1
• DOM-based dangling markup proof of concept 2

Tags

• csp
• info-leak
• dom
• xss
• sop-bypass
• csrf
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.