As the exploit isn't sent to the server (using #payload), can I say that a DOM XSS is a vulnerability in the browser rather than the web application?

4 Answers 4


As the application provides the logic that results in unexpected behavior DOM based XSS is clearly an application issue.

DOM-based XSS protections are built-in to many modern browsers, but you should not rely on them as they protect against a smaller subset of attacks.

Edited to clarify that one should not rely upon browser features for XSS protections.

  • DOM-based XSS protections are built-in to many modern browsers though. Examples?
    – copy
    Commented Jul 1, 2013 at 14:02
  • The latest browser where I was able to trigger a schoolbook example DOM-based XSS (sg. like document.write(document.location.href)) was IE6 if I remember correctly.
    – buherator
    Commented Jul 1, 2013 at 15:49
  • 2
    document.write(document.location.href) only fails because of URL-encoding. The traditional example of DOM XSS, element.innerHTML='Hello '+user_input, is not prevented by either of the extant browser anti-XSS schemes. Browser anti-XSS only deals with input directly reflected into the immediate HTML, which is a small subset of injection problems (and even then it can't catch every possible case). Do not rely on it.
    – bobince
    Commented Jul 1, 2013 at 19:29

So what is the application? There are frameworks like Backebone.js which implement the entire MVC of the application in JavaScript on the client. The server-side component of this very small, and just a data access layer.

So to answer your question, DOM Based XSS affects the client-side component of a web application.


Document Object Model vulnerability is an XSS attack wherein the attack payload is executed as result of modifying the DOM environment. The javascript code is executed on the client side so I can say that its an application side vulnerability.

DOM-based vulnerability example - http://www.example.com/pages.html?default=alert(document.cookie)

See OWASP for more information about XSS DOM-based vulnerabilities


It's an application vulnerability. Some browsers go quite far in trying to prevent it, but the problem is not the browser, but the client-side part of the application.

Modifying the DOM from JavaScript is a common and useful technique, even (or especially) using dynamically-constructed document structure. Because of this, a browser that knows nothing about the intended application logic can only stop the most obvious attacks, and while it is nice that they try to do this, the main responsibility is with the application, not the browser.

You must log in to answer this question.