The tag name is the payload: a browser XSS trick filters never think to read

The reason a scanner misses this is positional. Sanitizers normalise tag names and WAF signatures inspect attributes and the short list of elements everyone knows to fear, so the name itself is treated as a label rather than a place code can hide. Reading it back through localName defeats exactly that assumption ^[2].

The chain that does the reading is short. Any element can be made focusable with tabindex, an onfocus handler can be aimed at itself, and a string written to attributes[0].value is converted into a function that new then invokes ^[3][4]. A signature hunting for alert( inside a known tag or an on* attribute value has nothing to catch, because the executable text is sitting in the tag-name slot the filter was built to skip.

Blocklists that anticipate one property do not fare much better. If attributes[0].value is filtered, textContent and nodeValue reach the same handler ^[9]. The part attribute splits its value into an array that can be chained to overwrite the event and onfocus variables and pass the lowercase name to eval ^[11]. An opening angle bracket folded into the name, combined with the first attribute and written to innerHTML, produces fresh markup rather than a call ^[10]. Fuzzing the transformations showed alphabetic characters, slashes, whitespace and newlines get rewritten, while Unicode line and paragraph separators survive and are read as newlines by JavaScript, so the same payload can wear odd shapes ^[8].

The takeaway is a class of problem, not one element. Properties that look harmless, localName, part and classList among them, can carry payloads or perform transformations that no signature modelled ^[13]. Anything defending on a deny list of tag names and attribute strings is matching a surface the browser does not respect, which is why the dull answer, an allow list of elements and attributes with proper output encoding, is the one that survives a filter's obligation to enumerate every place a browser might stash runnable text.