Shazzer logo

Chars allowed between src and = in img tag

Chrome logo 5
Firefox logo 5
Edge logo 5

Shows characters that are allowed between src and = in an img tag.

rootd4ddy
Created byrootd4ddy
Created Mar 2, 2025
Updated May 28, 2025

Tweet
Detecting browser...
CategoryHTML Parsing
VisibilityPublic
TypeXSS
CharsetUTF-8
Code used before fuzz:
<script>0x0D
window.onerror = () => true; 0x0D
</script>0x0D
Template used:
<img src$[chr]=data:text/plain, id="testImg">
Code used after fuzz:
const img = document.getElementById('testImg');0x0D
if (img.hasAttribute('src') && img.getAttribute('src') === 'data:text/plain,') {0x0D
    log($[i]);0x0D
}

Sample payloads

<img src0x09=data:text/plain, id="testImg">
<img src
=data:text/plain, id="testImg">
<img src0x0C=data:text/plain, id="testImg">
<img src0x0D=data:text/plain, id="testImg">
<img src =data:text/plain, id="testImg">

Fuzz results

Chrome logo
Chrome 144.0.0.0 desktop Windows NT 10.0

Updated

Sun Jan 25 2026
Found 5 results
Loading...
Chrome logo
Chrome 140.0.7339.0 desktop Windows NT 6.1older version

Updated

Sun Jan 25 2026
Found 5 results
Loading...
Chrome logo
Chrome 132.0.0.0 desktop Linux Unknownolder version

Updated

Sun Mar 02 2025
Found 5 results
Loading...
Firefox logo
Firefox 147.0 desktop Linux

Updated

Sun Feb 01 2026
Found 5 results
Loading...
Edge logo
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0

Updated

Fri Jan 30 2026
Found 5 results
Loading...