Shazzer logo
Login

Non-standard characters that break JSON.parse()

Chrome logo 29
Firefox logo 29
Edge logo 29
Safari logo 29

Characters that will break a JSON.parse() that do not include chars within standard JSON-format.

DreyAnd
Created byDreyAnd
Created Nov 15, 2024
Updated May 27, 2025

Tweet
Detecting browser...
CategoryXSS Execution
VisibilityPublic
TypeJS
CharsetUTF-8
Template used:
try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint($[i]))) { 0x0D
        JSON.parse(`{"test":"$[chr]"}`);0x0D
    }0x0D
} catch {0x0D
    log($[i]);0x0D
}0x0D

Sample payloads

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(0))) { 0x0D
        JSON.parse(`{"test":"0x00"}`);0x0D
    }0x0D
} catch {0x0D
    alert(0);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(1))) { 0x0D
        JSON.parse(`{"test":"0x01"}`);0x0D
    }0x0D
} catch {0x0D
    alert(1);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(2))) { 0x0D
        JSON.parse(`{"test":"0x02"}`);0x0D
    }0x0D
} catch {0x0D
    alert(2);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(3))) { 0x0D
        JSON.parse(`{"test":"0x03"}`);0x0D
    }0x0D
} catch {0x0D
    alert(3);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(4))) { 0x0D
        JSON.parse(`{"test":"0x04"}`);0x0D
    }0x0D
} catch {0x0D
    alert(4);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(5))) { 0x0D
        JSON.parse(`{"test":"0x05"}`);0x0D
    }0x0D
} catch {0x0D
    alert(5);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(6))) { 0x0D
        JSON.parse(`{"test":"0x06"}`);0x0D
    }0x0D
} catch {0x0D
    alert(6);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(7))) { 0x0D
        JSON.parse(`{"test":"0x07"}`);0x0D
    }0x0D
} catch {0x0D
    alert(7);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(8))) { 0x0D
        JSON.parse(`{"test":"0x08"}`);0x0D
    }0x0D
} catch {0x0D
    alert(8);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(11))) { 0x0D
        JSON.parse(`{"test":"0x0B"}`);0x0D
    }0x0D
} catch {0x0D
    alert(11);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(12))) { 0x0D
        JSON.parse(`{"test":"0x0C"}`);0x0D
    }0x0D
} catch {0x0D
    alert(12);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(14))) { 0x0D
        JSON.parse(`{"test":"0x0E"}`);0x0D
    }0x0D
} catch {0x0D
    alert(14);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(15))) { 0x0D
        JSON.parse(`{"test":"0x0F"}`);0x0D
    }0x0D
} catch {0x0D
    alert(15);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(16))) { 0x0D
        JSON.parse(`{"test":"0x10"}`);0x0D
    }0x0D
} catch {0x0D
    alert(16);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(17))) { 0x0D
        JSON.parse(`{"test":"0x11"}`);0x0D
    }0x0D
} catch {0x0D
    alert(17);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(18))) { 0x0D
        JSON.parse(`{"test":"0x12"}`);0x0D
    }0x0D
} catch {0x0D
    alert(18);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(19))) { 0x0D
        JSON.parse(`{"test":"0x13"}`);0x0D
    }0x0D
} catch {0x0D
    alert(19);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(20))) { 0x0D
        JSON.parse(`{"test":"0x14"}`);0x0D
    }0x0D
} catch {0x0D
    alert(20);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(21))) { 0x0D
        JSON.parse(`{"test":"0x15"}`);0x0D
    }0x0D
} catch {0x0D
    alert(21);0x0D
}0x0D

try {0x0D
    standard_chars = [0x0D
        `"`, `'`, `,`, `\n`, `\t`, `\r`, `}`, `{`, `\\`0x0D
    ];0x0D
0x0D
    if (!standard_chars.includes(String.fromCodePoint(22))) { 0x0D
        JSON.parse(`{"test":"0x16"}`);0x0D
    }0x0D
} catch {0x0D
    alert(22);0x0D
}0x0D

Fuzz results

Chrome logo
Chrome 145.0.0.0 desktop Windows NT 10.0
Updated17 Feb 2026
Found 29 results
Loading...
Chrome logo
Chrome 127.0.0.0 desktop Linux Unknownolder version
Updated15 Nov 2024
Found 29 results
Loading...
Firefox logo
Firefox 147.0 desktop Linux
Updated1 Feb 2026
Found 29 results
Loading...
Firefox logo
Firefox 140.0 desktop Linux Unknownolder version
Updated9 Feb 2026
Found 29 results
Loading...
Edge logo
Microsoft Edge 145.0.0.0 desktop Windows NT 10.0
Updated18 Feb 2026
Found 29 results
Loading...
Safari logo
Safari 18.6 mobile iOS 18.6
Updated20 Aug 2025
Found 29 results
Loading...

Distributed Fuzzing

Enabled:
Status:disconnected
Your browser automatically contributes to distributed fuzzing when idle.