CVE-2026-65904
Undergoing Analysis Undergoing Analysis - In Progress

Cross-Realm XSS Bypass in DOMPurify via IN_PLACE Mode

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65904
EUVD
EUVD-2026-48273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dompurify dompurify to 3.3.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DOMPurify through version 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element comes from a different window or realm, such as an iframe's contentDocument. A flawed cross-realm instanceof check causes DOMPurify to incorrectly stringify the element and disable IN_PLACE mode, returning the unsanitized element with XSS payloads intact.

Detection Guidance

To detect this vulnerability, inspect applications using DOMPurify versions 3.3.3 or earlier in IN_PLACE mode. Check if DOM elements from cross-window contexts (e.g., iframes) are passed to DOMPurify without proper sanitization. Review server logs for unusual string outputs like '[object HTMLDivElement]' in sanitized outputs.

Impact Analysis

This vulnerability allows XSS attacks when applications use DOMPurify's IN_PLACE mode with cross-window elements. Attackers could inject malicious scripts that execute in the context of the main document, potentially stealing data or performing unauthorized actions.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.4 or later. Avoid using IN_PLACE mode with cross-window DOM elements. Replace IN_PLACE mode with standard sanitization of HTML strings to prevent XSS payloads from bypassing sanitization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart