Shazzer logo

Difference between browser-supported handlers and Shazzer 'all_browser_events' list

Chrome logo 1
Firefox logo 1
Edge logo 1

The shazzer's 'all_browser_events' list is compared with the event handler set from within the window, document.body and document objects combined. Result is missing events within the shazzer's 'all_browser_events' list.

hansmach1ne
Created byhansmach1ne
Created Jan 5, 2025
Updated May 27, 2025

Tweet
Detecting browser...
CategoryXSS Execution
VisibilityPublic
TypeJS
CharsetUTF-8
$[data1] placeholderall_browser_events
Code used before fuzz:
function listAllEventHandlers() {0x0D
    const allHandlers = new Set();0x0D
    const objects = [document.body, document, window];0x0D
    objects.forEach(obj => {0x0D
        for (const prop in obj) {0x0D
            if (prop.startsWith('on')) {0x0D
                allHandlers.add(prop);0x0D
            }0x0D
        }0x0D
    });0x0D
    return Array.from(allHandlers).sort();0x0D
}0x0D
allBodyHandlers = listAllEventHandlers();0x0D
0x0D
console.log("window, document and document.body contain " + allBodyHandlers .length + " handlers")0x0D
0x0D
const shazzerEvents  = new Set();
Template used:
shazzerEvents.add('$[data1]');
Code used after fuzz:
console.log("Shazzer 'all_browser_events' contains " + shazzerEvents.size + " events");0x0D
0x0D
function missingHandlers() {0x0D
const out = new Set();0x0D
    for(let handler of allBodyHandlers) {0x0D
        if (!shazzerEvents.has(handler)) {0x0D
            out.add(handler);0x0D
        }0x0D
    }0x0D
return out;0x0D
}0x0D
0x0D
for(let handler of missingHandlers()){0x0D
   log(handler);0x0D
}

Sample payloads

shazzerEvents.add('oncommand');

Fuzz results

Chrome logo
Chrome 144.0.0.0 mobile Android 10
Updated31 Jan 2026
Found 1 result
Loading...
Chrome logo
Chrome 143.0.0.0 desktop macOS 10.15.7older version
Updated28 Jan 2026
Found 1 result
Loading...
Chrome logo
Chrome 143.0.0.0 desktop Windows NT 10.0older version
Updated31 Jan 2026
Found 1 result
Loading...
Firefox logo
Firefox 147.0 desktop Linux
Updated1 Feb 2026
Found 1 result
Loading...
Edge logo
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0
Updated31 Jan 2026
Found 1 result
Loading...