Shazzer logo

List of HTML elements that convert to arbitrary string

Chrome logo 2
Safari logo 2
Firefox logo 2

When an element is used as a string it is converted using toString. Most elements convert to something like [object HTMLDivElement] but some dont

Created by: joaxcar

Created on: Wednesday, April 10, 2024 at 12:48:20 PM

Updated on: Friday, May 23, 2025 at 9:54:25 AM


Detecting browser...

Category: HTML Parsing

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Vector data 1: html

Template used:
<$[data1] id="x"></$[data1]>
Code used after fuzz:
x.toString().startsWith('[') || log('$[data1]')

Sample payloads

<a id="x"></a>
<area id="x"></area>

Fuzz results

Chrome logo
Chrome 144.0.0.0 desktop macOS 10.15.7

Updated

Sat Jan 31 2026
Found 2 results
Loading...
Chrome logo
Chrome 143.0.0.0 desktop Windows NT 10.0older version

Updated

Sat Jan 31 2026
Found 2 results
Loading...
Chrome logo
Chrome 123.0.0.0 Unknown Unknownolder version

Updated

Thu Apr 11 2024
Found 2 results
Loading...
Firefox logo
Firefox 124.0 Unknown Unknown

Updated

Wed Apr 10 2024
Found 2 results
Loading...
Safari logo
Safari 16.4 Unknown Unknown

Updated

Wed Apr 10 2024
Found 2 results
Loading...