Collected research

Under the Beamer

Under the Beamer. Tags:Writeup - Writeup - ASIS_QUALS_2025 - Web

kevin_mizu · mizu.re

DOM clobbering gadget in a widget library. Because named items of an HTML collection are not writable, injected elements sharing an identifier stop the library assigning its own escaping function; a second gadget removes the clobbering node so escaping is skipped, and a clobbered domain option reaches an iframe source unescaped, giving XSS past DOMPurify.

Record

Document

Under the Beamer. Tags:Writeup - Writeup - ASIS_QUALS_2025 - Web

Researcher

kevin_mizu

Published by

mizu.re

Topic

Other

In the archive

• Collected in the 2025 research round

Tags

• dom-clobbering
• sanitizer-bypass
• xss
• gadget-chain
• dom
• javascript
• case-study
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of kevin_mizu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.