PortSwigger researcher Gareth Heyes discovered a novel XSS technique using lowercase tag names via the `localName` property, enabling creative script injection even in strict environments. The technique chains HTML parsing behavior with JavaScript to bypass WAFs and works across all major browsers.
Background
PortSwigger is a well-known web security research organization. This research builds on long-standing knowledge of HTML tag name parsing rules in browsers, discovering that `localName` preserves original casing unlike `tagName` which uppercases.
- Source
- Lobsters
- Published
- Aug 26, 2026 at 02:36 PM
- Score
- 7.0 / 10