Browser & Web Performance · Senior · Question 50 of 75

What is DOM clobbering?

<a id="config" href="https://evil.example"></a>
<script>
  const url = window.config?.href || "/default.js";
</script>

1Deleting DOM nodes faster than React can render them
✓Correct answer: Injected HTML with id or name attributes creates global variables that override what scripts expect
3A memory leak from detached DOM nodes

Explanation

Even sanitized HTML without scripts can clobber globals. Avoid reading config from globals and use explicit declarations.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.