Characters allowed javascript and colon

Chrome logo 3
Safari logo 3
Firefox logo 3

Vector to check if any characters are allowed between javascript and : to still result in a javascript url.

Created by: renniepak

Created on: Tuesday, April 9, 2024 at 5:52:50 PM

Updated on: Wednesday, May 28, 2025 at 11:16:43 AM


Vector type: JS

Vector charset: UTF-8

Template used:
if (new URL("javascript$[chr]:alert()").protocol=="javascript:"){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

if (new URL("javascript	:alert()").protocol=="javascript:"){alert(9)}
if (new URL("javascript::alert()").protocol=="javascript:"){alert(58)}
if (new URL("javascript\:alert()").protocol=="javascript:"){alert(92)}

Fuzz results

Chrome logo
Chrome 123.0.0.0 Unknown Unknown

Updated

Tue Apr 09 2024
Found 3 results
Loading...
Safari logo
Safari 17.2.1 Unknown Unknown

Updated

Tue Apr 09 2024
Found 3 results
Loading...
Chrome logo
Chrome 137.0.0.0 desktop macOS 10.15.7

Updated

Wed Jun 11 2025
Found 3 results
Loading...
Firefox logo
Firefox 139.0 desktop macOS 10.15

Updated

Wed Jun 11 2025
Found 3 results
Loading...
Safari logo
Safari 18.5 desktop macOS 10.15.7

Updated

Wed Jun 11 2025
Found 3 results
Loading...