Collected research

XSS in GMail's AMP4Email via DOM Clobbering

@SecurityMB · research.securitum.com · 18 November 2019

AMP4Email in Gmail allowed the id attribute, so DOM clobbering was possible. Two anchors sharing an id yield an HTMLCollection whose members can be addressed by name, and an anchor stringifies to its href, letting an attacker clobber the AMP_MODE and testLocation globals and point AMP's script loader at an attacker URL for XSS.

Record

Researcher

@SecurityMB

Published by

research.securitum.com

Date

18 November 2019

Topic

XSS

In the archive

• Collected in the 2019 research round

Related sources

• AMP4Email DOM-clobbering challenge

Tags

• dom-clobbering
• xss
• dom
• filter-bypass
• email
• csp
• javascript
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of @SecurityMB, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.