Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains

This vector shows Unicode characters that have a decomposition of 2 or more ASCII characters, which get normalized by the browser. These characters are valid for use as domain names, expanding short strings into longer ones through decomposition.

Created by0x999-x

Created May 7, 2025

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<a id="x" href="https://$[chr].com">

Code used after fuzz:

function is_domain(domain) {0x0D
  return domain.split('.').every(part => /^[a-z0-9-]+$/i.test(part));0x0D
}0x0D
let host = x.host.replace('.com', '')0x0D
if(host.length > 1 && host.length < 5 && is_domain(host)){0x0D
log($[i] + "=>" + host)0x0D
}

Sample payloads

<a id="x" href="https://0x00.com">

Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains

Sample payloads

Fuzz results

Distributed Fuzzing