Don't Trust The DOM: Bypassing XSS Mitigations Via Script Gadgets by Sebastian Lekies