HTML-Encoded Attribute Escape

Checks for any escaping from the img tag attribute from encoded input without using double quotes

Fuzzer

Created byIDKdir

The fuzzing network isn't running this vector

Reported as broken by 2 engines (Blink, Gecko) with no successful result. Editing the template, init or after code, type, charset or data references puts it back on the network.

Created Jul 13, 2024

Updated Aug 13, 2026

Unable to render tweet button

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<img src="/image.png" tag="html($[chr])><iframe><!--">

Code used after fuzz:

if (document.querySelector('iframe')) {0x0D
    log($[chr]);0x0D
}

Sample payloads

<img src="/image.png" tag="0x00><iframe><!--">

Distributed Fuzzing

HTML-Encoded Attribute Escape

Sample payloads

Fuzz results