Skip to main content

06. Shadow DOM XSS Hunting Points

Modern frontends use Web Components to encapsulate UI inside the Shadow DOM. However, some sanitizers inspect only the light DOM. In that case, injecting unsafe HTML through a root exposed with attachShadow({mode:"open"}) can lead to XSS.

Checklist​

  • Check whether innerHTML or insertAdjacentHTML is used inside a shadowRoot
  • Even with CSP, an unset trustedTypes policy leaves substantial room for bypasses
  • Check whether the framework's templates offer options similar to dangerouslySetInnerHTML

Simple PoC Flow​

  1. User input is passed into component props
  2. The props are rendered directly as HTML
  3. A script executes inside an open shadowRoot

Mitigation​

Apply the same sanitizer and template policies inside the Shadow DOM. When possible, enforce mode:"closed" together with Trusted Types.