innerHTML, outerHTML, insertAdjacentHTML, document.write, inline events, and DOM mutations.
eval(), Function, and apply/call helpers with tainted payloads.
window.open, navigation.navigate, and source-scoped redirect sinks.
pushState, replaceState, and navigation.navigate using route-derived sources.
Form action/formAction target hijack and dangerous javascript:/data: form schemes.
Response-derived DOM reachability and response-driven form target coverage.
Controlled prototype writes plus fetch(init) impact validation.
location.*, history navigation, and href/src/action/formaction manipulation.
Assign attacker-controlled URLs to <script> elements.
Cookie, storage, window.name, hash route, postMessage, and referrer driven DOM XSS.
Secondary-source taint reaching eval, Function, and string timers.
Tainted route/query/storage/message values passed to new WebSocket(url).
Tainted File metadata used through readAsText, readAsDataURL, and readAsArrayBuffer.
document.evaluate() with tainted XPath expressions.
openDatabase and executeSql coverage for tainted client-side SQL flows.
Named-property clobbering via attacker-controlled id/name values.
DOMParser, contextual fragments, and setHTMLUnsafe parser-like sinks.
JSON.parse sink coverage for tainted JSON payloads.
document.domain assignments with tainted inputs.
fetch, XHR, sendBeacon, and image beacons with tainted values.
localStorage, sessionStorage, and cookie persistence of sensitive data.
Wildcard and cross-origin postMessage flows.
iframe.src and iframe.srcdoc flows.
setTimeout/setInterval string execution sinks.
WebSocket and RTCDataChannel send sinks.
console.log and console.error on tainted secrets.
navigator.clipboard.writeText exfiltration.
BroadcastChannel and MessageChannel postMessage flows.
ServiceWorker and Worker constructor flows pointing at tainted script URLs.
Blob and object-URL payloads flowing into script, iframe, worker, and window-opening sinks.
BroadcastChannel, MessagePort, and Worker messages driving DOM, code, and navigation sinks.
submit() and requestSubmit() executing tainted form targets.
Persisted browser state replayed into execution and request-shaping sinks.
Trusted Types callbacks and dangerous DOMPurify configuration with tainted input.
Credentialed cross-site fetches lacking CSRF material.
Headers, beacons, WebSocket/WebRTC, and postMessage reuse of session-like values.
Stored URLs and headers reused in fetch and XHR.