dom-clobbering

name	dom-clobbering
description	DOM clobbering — abuse named HTML elements to overwrite JavaScript global variables, bypass CSP, hijack object property lookups.
metadata	{"when_to_use":"dom clobbering window globals named elements anchor form innerhtml csp bypass","mitre_attack":"T1059.007","subdomain":"client-side","upstream_ref":"skills/_corpus/payloads/DOM Clobbering/"}

DOM Clobbering

Named HTML elements (<form>, <a>, <input>, <img>) with name= or id= are accessible as JavaScript properties of window and document. If app code does if (window.config.endpoint) and attacker can inject HTML (even sanitized), they can replace window.config with an HTML element.

1. The classic

<!-- App code -->
<script>
if (window.config && window.config.endpoint) {
    fetch(window.config.endpoint + '/data');
}
</>