Characters allowed between an object and the dot operator
List of characters allowed between an object and the dot operator located before the method/property.
Created by: cold-try
Created on: Monday, April 15, 2024 at 6:15:33 PM
Updated on: Thursday, May 15, 2025 at 4:37:01 PM
Detecting browser...
Category: XSS Execution
Vector visibility: Public
Vector type: JS
Vector charset: UTF-8
Template used:
window$[chr].alert();log($[i])Sample payloads
window⟦09⟧.alert();alert(9)window
.alert();alert(10)window0x0B.alert();alert(11)window0x0C.alert();alert(12)window0x0D.alert();alert(13)window .alert();alert(32)window?.alert();alert(63)window .alert();alert(160)window .alert();alert(5760)window .alert();alert(8192)window .alert();alert(8193)window .alert();alert(8194)window .alert();alert(8195)window .alert();alert(8196)window .alert();alert(8197)window .alert();alert(8198)window .alert();alert(8199)window .alert();alert(8200)window .alert();alert(8201)window .alert();alert(8202)Fuzz results
Chrome 144.0.0.0 desktop macOS 10.15.7
Updated
Sat Jan 31 2026
Found 26 results
Loading...
Chrome 143.0.0.0 desktop Windows NT 10.0older version
Updated
Sat Jan 31 2026
Found 26 results
Loading...
Chrome 123.0.0.0 Unknown Unknownolder version
Updated
Mon Apr 15 2024
Found 26 results
Loading...
Firefox 124.0 Unknown Unknown
Updated
Mon Apr 15 2024
Found 26 results
Loading...
Safari 15.5 Unknown Unknown
Updated
Mon Apr 15 2024
Found 26 results
Loading...