DOM XSS, PoC, Example, Referrer, Javascript Injection
Document Object Model Javascript Injection via document.referrer
This page will alert a tainted document.referrer in most User Agents:
Public Domain DOM XSS PoC by XSS.MS