Characters allowed inside javascript protocol and still returns the hostname



want to test if new URL('javascript://xss.com') can still return the hostname on all characters
Created by: RenwaX23
Created on: Monday, July 21, 2025 at 8:36:05 AM
Updated on: Monday, July 21, 2025 at 8:36:05 AM
Vector type: JS
Vector charset: UTF-8
Template used:
if (new URL("javascript$[chr]://xss.com").host=="xss.com"){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
if (new URL("javascript ://xss.com").host=="xss.com"){alert(9)}
if (new URL("javascript+://xss.com").host=="xss.com"){alert(43)}
if (new URL("javascript-://xss.com").host=="xss.com"){alert(45)}
if (new URL("javascript.://xss.com").host=="xss.com"){alert(46)}
if (new URL("javascript0://xss.com").host=="xss.com"){alert(48)}
if (new URL("javascript1://xss.com").host=="xss.com"){alert(49)}
if (new URL("javascript2://xss.com").host=="xss.com"){alert(50)}
if (new URL("javascript3://xss.com").host=="xss.com"){alert(51)}
if (new URL("javascript4://xss.com").host=="xss.com"){alert(52)}
if (new URL("javascript5://xss.com").host=="xss.com"){alert(53)}
if (new URL("javascript6://xss.com").host=="xss.com"){alert(54)}
if (new URL("javascript7://xss.com").host=="xss.com"){alert(55)}
if (new URL("javascript8://xss.com").host=="xss.com"){alert(56)}
if (new URL("javascript9://xss.com").host=="xss.com"){alert(57)}
if (new URL("javascriptA://xss.com").host=="xss.com"){alert(65)}
if (new URL("javascriptB://xss.com").host=="xss.com"){alert(66)}
if (new URL("javascriptC://xss.com").host=="xss.com"){alert(67)}
if (new URL("javascriptD://xss.com").host=="xss.com"){alert(68)}
if (new URL("javascriptE://xss.com").host=="xss.com"){alert(69)}
if (new URL("javascriptF://xss.com").host=="xss.com"){alert(70)}
Fuzz results

Chrome 138.0.0.0 desktop macOS 10.15.7
Updated
Mon Jul 21 2025
Found 67 results
Loading...

Safari 19.0 desktop macOS 10.15.7
Updated
Mon Jul 21 2025
Found 67 results
Loading...

Chrome 138.0.0.0 desktop Windows NT 10.0
Updated
Mon Jul 21 2025
Found 67 results
Loading...

Firefox 140.0 desktop macOS 10.15
Updated
Mon Jul 21 2025
Found 65 results
Loading...