Merging untrusted JSON onto `{}` can set `__proto__` / `constructor.prototype` — affects all objects.

Web Security

Prototype pollution

<h2>Summary</h2>
<p>Named elements (<code>&lt;img name="x"&gt;</code>) inject properties on <code>window</code>/<code>document</code> — can break scripts expecting undefined. CSP and sanitization reduce injection vectors. Avoid <code>document.x</code> patterns; use <code>getElementById</code>. Legacy apps and third-party HTML embeds are vulnerable.</p>
<h2>Code example</h2>
<pre><code class="language-javascript">// Avoid: document.config — clobberable by injected named elements
const config = document.getElementById('app-config')?.dataset;

// Prefer explicit IDs over named DOM lookups
</code></pre>
<h2>Key points</h2>
<ul>
<li>Named elements (<code>&lt;img name="x"&gt;</code>) inject properties on <code>window</code>/<code>document</code> — can break scripts expecting undefined.</li>
<li>CSP and sanitization reduce injection vectors.</li>
<li>Avoid <code>document.x</code> patterns; use <code>getElementById</code>.</li>
<li>Legacy apps and third-party HTML embeds are vulnerable.</li>
</ul>
<h2>Further reading</h2>
<ul>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/API/Document">DOM clobbering</a></li>
<li><a href="https://web.dev/articles/trusted-types-xss">HTML sanitization</a></li>
</ul>
<h2>Related concepts</h2>
<ul>
<li><a href="/blogs/level-6-trusted-types">Trusted Types</a></li>
<li><a href="/blogs/level-6-prototype-pollution">Prototype pollution</a></li>
</ul>


Named elements (`<img name="x">`) inject properties on `window`/`document` — can break scripts expecting undefined.

DOM clobbering

Enforces typed DOM sinks — `innerHTML` requires TrustedHTML from policy, blocking DOM XSS injection.