commandline-be (4)

Mitigating aspect to consider here is the flaws were patched in more recent versions of Chrome and derivatives after 100.0.4892.0

Use of .nodeValue and .textContent to set attribute properties does not take an Exception-State since internal use of Attr::SetAttribute is not enforcing Trusted Type check as set by the HTTP header used to set CSP policy for Trusted Types. The nature of this vulnerability asks also to verify all other attribute methods to use Exception-State to ensure CSP Trusted Type checking in Chrome based browsers.

The resource example shows use of .nodeValue and .textContent to introduce DOM based-XSS, this though the flaw permitted for any javascript to execute.

resource: https://bugs.chromium.org/p/chromium/issues/detail?id=1298122
see comment 7 for a link to the WebIDL discussion where the flaw was likely introduced in case 2 Attr Node