As more and more rich interactive web applications are based on the HTML5's new capabilities by introducing native methods to improve user interactive experiences, XSS still ranks among as the top 3 vulnerabilities in the web application. There is a growing trend to one of its type - DOM-based XSS with the shift to the HTML5. However, due to the client nature of DOM-based XSS, there is no effective way to detect it in the open community. This work implemented tainted checking into the JavaScriptCore JavaScript engine and WebKit browser render engine. We modified String object by adding a tainted attribute to all DOM input interface, propagating this tainted attribute through all the String operations and detecting it at the DOM output interface. If the output was tainted, then we claimed the web application is DOM-based XSS vulnerable. By harnessing the power of PhantomJS, a headless browser for automation, we developed an ultimate DOM-based XSS detection scanner and a cloud infrastructure scanning our target products actively. It successfully caught production DOM-based XSS issues and reported back to us.