--- title: Tag names can run JavaScript now, and every browser is... description: Security researcher Gareth Heyes discovered that HTML tag names can be crafted to execute JavaScript across all major browsers, by exploiting how the localName... canonical: https://daily.dev/posts/tag-names-can-run-javascript-now-and-every-browser-is-affected-yzzircis8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tag names can run JavaScript now, and every browser is affected | daily.dev og:description: Security researcher Gareth Heyes discovered that HTML tag names can be crafted to execute JavaScript across all major browsers, by exploiting how the localName... og:url: https://daily.dev/posts/tag-names-can-run-javascript-now-and-every-browser-is-affected-yzzircis8 og:image: https://api.daily.dev/og/posts/YZzIrcIs8.png og:image:alt: Tag names can run JavaScript now, and every browser is affected og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tag names can run JavaScript now, and every browser is affected **[Trends](https://daily.dev/sources/trends)** · 2 min read · 2 upvotes · 1 comments ## Summary Security researcher Gareth Heyes discovered that HTML tag names can be crafted to execute JavaScript across all major browsers, by exploiting how the localName property lowercases unusual characters in tag names and chaining that with onfocus, tabindex, contenteditable, and DOM properties like attributes, part, classList, and setHTMLUnsafe. Because most signature-based WAFs and blocklists only look for JavaScript in conventional places like script tags or onerror attributes, these payloads slip past them undetected. This is not a single-browser bug that can be patched; it stems from fundamental HTML parsing behavior, so sanitizers need to be updated to account for it now. James Kettle, a well-known figure in web security research, retweeted the finding without comment, signaling its significance within the community. ## Content Gareth Heyes found something that shouldn't work and does: put a JavaScript URL inside an HTML tag name, and browsers will execute it. All of them. The [full writeup](https://portswigger.net/research/what-s-in-a-tag-name) is worth reading if you do anything security-adjacent. The short version: HTML tag names can contain unusual characters, and the browser's `localName` property returns a lowercased version of whatever's in there. Heyes chains that behavior with `onfocus` events, `tabindex`, `contenteditable`, and DOM properties like `attributes`, `part`, `classList`, and `setHTMLUnsafe` to construct XSS payloads that hide JavaScript inside what looks like a harmless tag name. The practical problem is WAF bypass. Most signature-based filters aren't looking for JavaScript inside tag names because nobody expected tag names to be executable. These payloads slip through blocklists that would catch conventional `