Tag-Splitting

Tag-splitting is an evasion method that breaks malicious markup into fragments so a sanitizer does not recognise the complete executable pattern. The browser later reconstructs the content into a valid script element, which allows hidden payloads to run after message rendering.

Expanded Definition

Tag-splitting is a cross-site scripting evasion technique that relies on fragmenting an otherwise obvious payload so a filter, sanitizer, or message renderer fails to detect the full executable structure. The fragments may be separated by comments, strings, encoding tricks, or parser-tolerant spacing, then reassembled by the browser’s HTML parser into active markup at render time. In security terms, the risk is not the fragment itself, but the eventual browser interpretation of the reconstructed DOM. NHI Management Group treats this as a parser-differential problem: the defense path sees one representation, while the browser sees another. That is why validation must be performed on the post-normalised output and not only on the raw input.

Definitions vary across vendors and libraries because some products classify tag-splitting as a generic sanitization bypass while others fold it into broader XSS filter evasion. There is no single standard that governs the tactic itself, but the underlying security objective is consistent with the NIST Cybersecurity Framework 2.0 emphasis on secure processing and protective controls. The most common misapplication is assuming that character filtering alone is sufficient, which occurs when teams validate only literal tag strings and ignore browser parsing behaviour.

Examples and Use Cases

Implementing defenses against tag-splitting rigorously often introduces compatibility constraints, requiring organisations to weigh stricter sanitization against the risk of breaking legitimate rich-text content or embedded formatting.

• A chat application strips obvious script tags but fails when an attacker splits the markup across innocuous-looking fragments that the browser later merges into executable HTML.
• A support portal allows user-generated comments and sanitizes only direct tag names, leaving room for tag-splitting payloads that survive until page render.
• An internal wiki accepts pasted content from email or document editors, where fragmented markup bypasses basic blacklist rules and becomes active after the browser normalizes the page.
• A security team tests a content filter by using standards-based parser behaviour and documents the gap between input scanning and browser reconstruction, reinforcing the need for robust context-aware encoding.
• For guidance on secure handling of web content, practitioners often pair sanitizer testing with browser behaviour analysis and the input validation principles described by OWASP.

Why It Matters for Security Teams

Tag-splitting matters because it exposes a common failure mode in web security: treating sanitization as a string-matching exercise instead of a parsing and rendering problem. Once an attacker can get fragmented markup past the first security boundary, downstream controls such as logging, moderation, and client-side protections may all observe the content too late. This becomes especially important in modern applications that support rich text, markdown conversion, embedded widgets, or AI-assisted content generation, where the line between benign formatting and executable markup can be narrow. Security teams need to align input handling, output encoding, and browser-safe rendering rules so that one subsystem cannot be bypassed by another’s assumptions.

For identity-heavy platforms, tag-splitting can also become a delivery vehicle for session theft, credential phishing, or token exfiltration when untrusted content is rendered alongside authenticated user context. Controls that reduce the attack surface include trusted sanitization libraries, strict content security policy enforcement, and validation of the rendered DOM rather than the raw payload alone. Organisations typically encounter the business impact only after a malicious message or post is rendered in production, at which point tag-splitting becomes operationally unavoidable to investigate and contain.

Related resources from NHI Mgmt Group

• How do teams decide whether an AI identity tag is reliable enough for action?
• What breaks when tag-based protection is not governed carefully?
• What breaks when consent categories are not mapped correctly to tag storage types?
• When should teams choose response headers instead of meta tag CSP?