A rendering sink is any code path where untrusted input is placed into a web page or UI component for display. In practice, it is the point where data becomes HTML, text, attribute content, or script-like markup. Common sinks include innerHTML, template rendering functions, tooltip builders, and label or popup fields in map widgets.
Rendering sinks matter because they are where output encoding and sanitization must happen. If attacker-controlled data reaches a sink without proper escaping, the browser may treat it as code instead of text, creating cross-site scripting risk. Defenders look for these sinks during code review, testing, and patching, then apply context-aware encoding, sanitization, and safer APIs that insert text rather than markup. In attacks, the sink is often the final step that turns a harmless field such as a pin label or metadata value into browser-side code injection.