# DOM clobbering via named elements

Unescaped attribute sinks letting id/name shadow document/window members that code trusts as native

_Area: Web injection and code execution. Seen in 3 disclosed reports; 2 confirmed bounties: $1,000 and $1,500; latest 2026-10-22. Updated 2026-10-23._

## How it works

Browsers expose elements carrying `id` or `name` attributes as properties on `document` and `window`. When user markup reaches the page unescaped, an attacker can name an element after an existing property or method (`write`, `querySelector`, `createElement`, `body`). The named element then shadows the real member, so application code calling `document.write(...)` or reading `document.body` receives the attacker's element instead of the native function or object. The assumption that breaks: that `document`/`window` members are always the built-ins the code expects. Code that trusts those members without checking their type can then throw or misbehave [E2](https://bugbountylibrary.com/r/h1%3A1077136.md).

## Where it shows up

- HTML injection points where injected markup is not fully escaped, especially link/URL fields reflected into HTML [E2](https://bugbountylibrary.com/r/h1%3A1077136.md).
- Attribute-value sinks: an attacker controlling an `id` or `name` value, not just element text, is what enables clobbering [E2](https://bugbountylibrary.com/r/h1%3A1077136.md).
- Code that calls `document.*` or `window.*` methods without verifying they are functions.
- Code that reads `document.body`, `document.forms`, or similar and assumes a native object.

## How to review

- Trace every sink where user input becomes HTML. Confirm escaping is unconditional and covers attribute values, so an attacker cannot introduce `id`/`name` attributes [E2](https://bugbountylibrary.com/r/h1%3A1077136.md).
- Confirm app code does not rely on `document`/`window` members being native. Look for type checks (`typeof x === 'function'`) or captured references taken before untrusted markup is inserted, and use them at the call site.
- The invariant: at every use of a `document`/`window` member, the value must be the native one, or the code must tolerate a non-native value without throwing or misbehaving. This requires both an unescaped attribute-value sink and a trusting call site [E2](https://bugbountylibrary.com/r/h1%3A1077136.md).

## Variants seen

- Named elements clobbering `document` methods to crash the app (DoS) [E2](https://bugbountylibrary.com/r/h1%3A1077136.md).

## Impact and severity

Led to channel and desktop-app crashes via DoS [E2](https://bugbountylibrary.com/r/h1%3A1077136.md). Severity rises when injection is reachable without script execution and when framework code trusts clobbered members, turning a cheap markup injection into a reliable outage.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-mrv2-3pqr-j5jr.md
- E2: https://bugbountylibrary.com/r/h1%3A1077136.md
- E3: https://bugbountylibrary.com/r/h1%3A246794.md