Collected research

Riding out DOMsday: Towards Detecting and Preventing DOM Cross-Site Scripting

William Melicher, Anupam Das, Mahmood Sharif, Lujo Bauer and Limin Jia · ndss-symposium.org

A browser with taint tracking in its JavaScript engine crawled the Alexa top 10,000 to measure DOM XSS, with a better test for whether a source-to-sink flow is truly exploitable, finding 83 percent more bugs than the prior method. It traces the causes, shows custom HTML templating can itself be buggy, and finds three static analysers miss 90 percent of the confirmed bugs.

Record

Researcher

William Melicher, Anupam Das, Mahmood Sharif, Lujo Bauer and Limin Jia

Published by

ndss-symposium.org

Format

Whitepaper

Topic

XSS

In the archive

• Collected in the 2018 research round

Related sources

• NDSS 2018 Riding out DOMsday: Towards Detecting and Preventing DOM Cross-Site Scripting

Tags

• xss
• dom
• javascript
• dynamic-analysis
• static-analysis
• measurement-study
• large-scale-scan
• detection
• owasp-a03-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of William Melicher, Anupam Das, Mahmood Sharif, Lujo Bauer and Limin Jia, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.