Shazzer logo

Characters allowed between an object and the dot operator

Chrome logo 26
Safari logo 26
Firefox logo 26

List of characters allowed between an object and the dot operator located before the method/property.

Created by: cold-try

Created on: Monday, April 15, 2024 at 6:15:33 PM

Updated on: Thursday, May 15, 2025 at 4:37:01 PM


Detecting browser...

Category: XSS Execution

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:
window$[chr].alert();log($[i])

Sample payloads

window09.alert();alert(9)
window
.alert();alert(10)
window0x0B.alert();alert(11)
window0x0C.alert();alert(12)
window0x0D.alert();alert(13)
window .alert();alert(32)
window?.alert();alert(63)
window .alert();alert(160)
window.alert();alert(5760)
window .alert();alert(8192)
window.alert();alert(8193)
window.alert();alert(8194)
window.alert();alert(8195)
window.alert();alert(8196)
window.alert();alert(8197)
window.alert();alert(8198)
window.alert();alert(8199)
window.alert();alert(8200)
window.alert();alert(8201)
window.alert();alert(8202)

Fuzz results

Chrome logo
Chrome 144.0.0.0 desktop macOS 10.15.7

Updated

Sat Jan 31 2026
Found 26 results
Loading...
Chrome logo
Chrome 143.0.0.0 desktop Windows NT 10.0older version

Updated

Sat Jan 31 2026
Found 26 results
Loading...
Chrome logo
Chrome 123.0.0.0 Unknown Unknownolder version

Updated

Mon Apr 15 2024
Found 26 results
Loading...
Firefox logo
Firefox 124.0 Unknown Unknown

Updated

Mon Apr 15 2024
Found 26 results
Loading...
Safari logo
Safari 15.5 Unknown Unknown

Updated

Mon Apr 15 2024
Found 26 results
Loading...