Reconstructing JavaScript from HTML Tag Names: An XSS and WAF Blocklist Evasion Technique

An XSS technique described in a 2026-08-25 article from PortSwigger Research, titled "What's in a tag name? JavaScript, apparently," involves an attacker placing a string containing JavaScript code into an HTML tag name. This string is then extracted and reconstructed as an event handler when the browser processes the HTML, bypassing Web Application Firewalls (WAFs) and blocklists that only look for typical script tags or event attribute payloads.

The reconstructed JavaScript runs in the context of the target web page after being triggered by a focus event, allowing for potential manipulation of the Document Object Model (DOM), access to information, or even authenticated actions. This technique poses a challenge for detection, as it may not be caught by standard XSS signatures or blocklists, especially when the attacker-controlled string is embedded within unusual HTML tag names or event attributes.

Successful execution requires the attacker's input to reach the browser as HTML, and the focus event must trigger without being blocked by Content Security Policy (CSP) or other controls.