A DOM sink is a browser-side code path where data from JavaScript is written into the page in a way that can change the DOM or create executable content. Common sinks include innerHTML, outerHTML, document.write, insertAdjacentHTML, and some uses of eval or event-handler assignment. A sink becomes dangerous when it receives untrusted input that has not been encoded or sanitized for that exact context.
DOM sinks matter because many cross-site scripting bugs are created client-side, after server-side filtering has already finished. Attackers look for places where user-controlled strings reach a sink and turn into HTML, script, or a malicious URL. Defenders audit sink usage, replace risky APIs with safer text-only methods like textContent, and enforce context-aware encoding plus Content Security Policy. In practice, finding the sink is often the key step in proving whether a payload can actually execute.