Properties that are accessible on location
This vector attempts to see which properties are available on the parent location object of sandboxed iframe.
Created by: hackvertor
Created on: Friday, June 7, 2024 at 8:01:40 PM
Updated on: Tuesday, May 27, 2025 at 8:16:15 AM
Category: Browser Quirks
Vector visibility: Public
Vector type: JS
Vector charset: UTF-8
Code used before fuzz:
const props = Object.getOwnPropertyNames(location);0x0D
props.forEach(prop => {0x0D
try {0x0D
if(typeof parent.location[prop] !== 'undefined') {0x0D
log(prop);0x0D
}0x0D
} catch{}0x0D
})Template used:
1337Detecting browser...
Sample payloads
1337Fuzz results
Chrome 144.0.0.0 desktop Windows NT 10.0
Updated
Sat Jan 31 2026
Found 1 result
Loading...
Chrome 143.0.0.0 desktop macOS 10.15.7older version
Updated
Wed Dec 10 2025
Found 1 result
Loading...
Firefox 146.0 desktop macOS 10.15
Updated
Wed Dec 10 2025
Found 1 result
Loading...
Safari 26.1 desktop macOS 10.15.7
Updated
Wed Dec 10 2025
Found 1 result
Loading...
Safari 17.5 mobile iOS 17.5.1older version
Updated
Fri Jun 07 2024
Found 1 result
Loading...