Running code on the client side is an inevitable part of modern web applications and services. However, this creates many potential security threats. Below are the 10 most common vulnerabilities that arise precisely because of client-side code execution, with real-world examples and recommendations for protection.
One of the most common problems is DOM-based XSS — cross-site scripting that occurs when a malicious script is injected into a dynamically created DOM through unverified data. As a result, an attacker can execute arbitrary JavaScript in the victim’s browser. A notable historical example is the “Samy Worm” on MySpace, which infected millions of profiles by spreading malicious code through XSS. Similar attacks are regularly reported on modern websites.
Reflected and Stored XSS are related vulnerabilities, but with different attack vectors. Reflected XSS is executed through malicious code passed in URLs or HTTP requests and reflected by the page, while Stored XSS stores the malicious script on the server and runs it for all visitors. The consequences can be serious, ranging from session cookie theft to complete user account takeover.
Cross-Site Request Forgery (CSRF) is an attack in which an attacker forces a user to perform an unwanted action on a trusted site (for example, transfer money or change settings). Since the requests appear legitimate, protection boils down to using CSRF tokens and special headers.
Insecure Direct Object References (IDOR) is a vulnerability where a user gains access to someone else’s resources simply by changing a URL parameter or identifier. This is possible when there is no access control on the server. Such vulnerabilities lead to confidential data leaks.
Open Redirect and Unvalidated Redirects are used to redirect victims to phishing sites via legitimate URLs, which undermines user trust and enables social engineering.
Formjacking is a dangerous type of attack in which attackers inject malicious JavaScript into forms on a website, intercepting payment details and other sensitive information. This method has been actively used in attacks on online stores.
Prototype Pollution is a lesser-known but extremely dangerous vulnerability in JavaScript, in which an attacker modifies the basic properties of objects through invalid input data. This can lead to application logic violations and the execution of malicious code.
The use of outdated JavaScript libraries also opens up many holes. In 2024, research showed that thousands of websites were using vulnerable versions of popular libraries, making them easy prey for attacks.
The absence or incorrect configuration of security headers such as Content-Security-Policy (CSP), X-Frame-Options, and HSTS allows XSS attacks, clickjacking, and MITM attacks. These headers are an important line of defense on the client side.
Finally, Client-Side Injection is a general class of vulnerabilities in which malicious code is injected through input fields or external libraries. Sometimes it enters trusted scripts through supply-chain attacks, making the threat even more difficult to detect.
Real-world incidents confirm the danger of these vulnerabilities. For example, the 2018 attack on British Airways via XSS allowed the theft of payment card data from tens of thousands of users. The Magento and Magecart hacks showed how a chain of vulnerabilities in client and server code can lead to large-scale leaks.
To protect yourself, you need to strictly validate and screen all user data, use modern CSRF tokens and secure cookies, update libraries, and monitor security headers. It is important to minimize client logic that works with sensitive data, as well as to regularly conduct security audits, testing, and monitoring.
Ultimately, client code security is not just a technical task, but a prerequisite for maintaining user trust and business resilience to modern threats.
