I'm struggling to understand how this flavor of dom clobbering actually works.

The green box at the top of this section of the HTML spec makes it pretty clear why I can access HTML elements as global variables on the window object. What I don't understand is why, in chrome, setting a tag's name attribute will overwrite javascript methods. For example,

<img name=getElementById>

I get

VM5014:1 Uncaught TypeError: document.getElementById is not a function

Can someone help me understand how the name attribute of an img tag overwrites methods on the document object?


  • Welcome to the community. First of all, if you want to access an element by ID you need to specify the element name or id in between the brackets as a variable or as a string with either double quotemarks or a single one. From both ends obviously. Oct 24, 2022 at 16:01

1 Answer 1


The thing is that you look at some code in different ways before and after the attack:

If you have:


This calls getElementById() on the site (cf Mozilla Documentation). Which gets you the element for a specific id if present.

But what if the function getElementById can be overwritten? This is the case if you create an HTMLCollection at document. You can do that using multiple name attributes (cf. DOM clobbering in sanitized MD causes errors):

<img name="getElementById" src="">
<img name="getElementsByTagName" src="">

After that document.getElementById() will go to nowhere and the site could fail if this frequent used function is used.

For a deeper understanding also refer to this Stack Overflow question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.