Browser parsing quirk allows arbitrary JavaScript execution via malformed HTML tag names

The event centers on a browser parsing behavior where unconventional HTML tag names, such as `<alert(1)>` or `<JAVASCRIPT:ALERT(1)>`, are not rejected but instead processed in ways that enable JavaScript execution. The researcher leveraged properties like `localName`, which returns the tag name in lowercase, to construct payloads that bypass typical sanitization checks. This is not a bug in the traditional sense but a consequence of browsers prioritizing leniency over strict adherence to HTML specifications, particularly in how they handle tag names and attributes.

The attack vectors rely on chaining browser APIs and event handlers to transform seemingly harmless tag names into executable code. For example, combining `onfocus` with `attributes[0].value` or `getAttributeNode` allows the tag name to be dynamically assigned as a function and executed. The use of `contenteditable` or `tabindex` to make elements focusable, or `setHTMLUnsafe` to inject markup, further expands the attack surface. These techniques are effective across all major browsers, indicating a systemic issue rather than an implementation flaw in a single engine.

The implications for engineers are twofold. First, input validation and WAF rules must account for edge cases in tag name parsing, including uppercase JavaScript syntax and non-alphanumeric characters like line separators. Second, browser APIs such as `localName`, `part`, and `classList`, often overlooked in security reviews, can become vectors for payload delivery. The researcher’s findings underscore the need for defensive coding practices that assume browser leniency, such as strict allowlisting of tag names and attributes, rather than relying on blocklists or assumptions about how browsers will interpret malformed markup.

The event also highlights the role of automated tools in discovering variants of these attacks. The researcher used an unnamed tool (referred to as 'Sol 5.6') to generate additional payloads, such as those leveraging `getAttributeNode` or `classList`. This suggests that similar vulnerabilities may exist in other browser APIs or properties that have not yet been thoroughly audited. Engineers should treat browser parsing quirks as a persistent risk and prioritize testing for unconventional input patterns, particularly in applications where user-generated HTML is rendered.