Tags that get reordered in the DOM

This vector shows which tags when nested reorder the DOM.

Created Jan 21, 2025

Updated May 27, 2025

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml

$[data2] placeholderhtml

Template used:

<div id=x>0x0D
<$[data1]><$[data2]></$[data2]></$[data1]>0x0D
</div>

Code used after fuzz:

"$[data1]" != "$[data2]" && x.innerHTML.trim().startsWith("<$[data2]>") && x.innerHTML.trim().includes("<$[data1]>") && log('$[data1]->$[data2]')

Sample payloads

<div id=x>0x0D
<table->a><></></table->a>0x0D
</div>

<div id=x>0x0D
<table->abbr><></></table->abbr>0x0D
</div>

<div id=x>0x0D
<table->acronym><></></table->acronym>0x0D
</div>

<div id=x>0x0D
<table->address><></></table->address>0x0D
</div>

<div id=x>0x0D
<table->area><></></table->area>0x0D
</div>

<div id=x>0x0D
<table->article><></></table->article>0x0D
</div>

<div id=x>0x0D
<table->aside><></></table->aside>0x0D
</div>

<div id=x>0x0D
<table->audio><></></table->audio>0x0D
</div>

<div id=x>0x0D
<table->b><></></table->b>0x0D
</div>

<div id=x>0x0D
<table->base><></></table->base>0x0D
</div>

<div id=x>0x0D
<table->bdi><></></table->bdi>0x0D
</div>

<div id=x>0x0D
<table->bdo><></></table->bdo>0x0D
</div>

<div id=x>0x0D
<table->big><></></table->big>0x0D
</div>

<div id=x>0x0D
<table->blockquote><></></table->blockquote>0x0D
</div>

<div id=x>0x0D
<table->br><></></table->br>0x0D
</div>

<div id=x>0x0D
<table->button><></></table->button>0x0D
</div>

<div id=x>0x0D
<table->canvas><></></table->canvas>0x0D
</div>

<div id=x>0x0D
<table->center><></></table->center>0x0D
</div>

<div id=x>0x0D
<table->cite><></></table->cite>0x0D
</div>

<div id=x>0x0D
<table->code><></></table->code>0x0D
</div>