Characters that can break out of an inline style background-image url

Chrome logo 1

Characters that can break out of an inline style background-image url

Created by: 0xdef1ant

Created on: Saturday, July 13, 2024 at 9:12:51 PM

Updated on: Thursday, November 21, 2024 at 5:00:12 AM

Vector type: XSS

Vector charset: UTF-8

Template used:
<div id="test" style="background-image: url($[chr];width:100%">hello</div>
Code used after fuzz:
let myDiv = document.getElementById("test");
function getCSSProperty(element, property) {
            return window.getComputedStyle(element).getPropertyValue(property);
        }
const width = getCSSProperty(myDiv, 'width');
if (width === '100%') {
log(String.fromCharCode($[i]))
  }
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

<div id="test" style="background-image: url(;width:100%">hello</div>

Fuzz results

Chrome logo
Chrome 124.0.0.0 desktop macOS 10.15.7

Updated

Sat Jul 13 2024
Found 1 result
Loading...