PortSwigger reveals XSS technique that hides JavaScript inside HTML tag names

Security researchers at PortSwigger have disclosed a cross-site scripting technique that embeds JavaScript-meaningful strings inside HTML tag names rather than conventional script or event attributes. When the browser parses the crafted HTML, properties like localName can retrieve the tag name as a string, which is then reconstructed into an executable event handler via attributes such as onfocus and autofocus. Because the payload avoids typical script tags and known XSS patterns, it can slip past web application firewalls and blocklists that rely on signature-based detection. The attack requires attacker-controlled input to reach an HTML context — such as through a CMS, comments, or reflected fields — and succeeds only if the application does not use an allowlist-based sanitizer, strict Content Security Policy, or proper output encoding. If successful, JavaScript executes within the target page's origin, potentially enabling DOM manipulation, data access, or authenticated actions on behalf of the victim.