Client-side prototype pollution to DOM XSS

A polluted prototype property read by a sink like a template loader or script src becomes reliable XSS without any server bug.