Characters allowed inside javascript protocol and still returns the hostname

Safari logo 67
Firefox logo 65
Chrome logo 67

want to test if new URL('javascript://xss.com') can still return the hostname on all characters

Created by: RenwaX23

Created on: Monday, July 21, 2025 at 8:36:05 AM

Updated on: Monday, July 21, 2025 at 8:36:05 AM


Vector type: JS

Vector charset: UTF-8

Template used:
if (new URL("javascript$[chr]://xss.com").host=="xss.com"){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

if (new URL("javascript	://xss.com").host=="xss.com"){alert(9)}
if (new URL("javascript+://xss.com").host=="xss.com"){alert(43)}
if (new URL("javascript-://xss.com").host=="xss.com"){alert(45)}
if (new URL("javascript.://xss.com").host=="xss.com"){alert(46)}
if (new URL("javascript0://xss.com").host=="xss.com"){alert(48)}
if (new URL("javascript1://xss.com").host=="xss.com"){alert(49)}
if (new URL("javascript2://xss.com").host=="xss.com"){alert(50)}
if (new URL("javascript3://xss.com").host=="xss.com"){alert(51)}
if (new URL("javascript4://xss.com").host=="xss.com"){alert(52)}
if (new URL("javascript5://xss.com").host=="xss.com"){alert(53)}
if (new URL("javascript6://xss.com").host=="xss.com"){alert(54)}
if (new URL("javascript7://xss.com").host=="xss.com"){alert(55)}
if (new URL("javascript8://xss.com").host=="xss.com"){alert(56)}
if (new URL("javascript9://xss.com").host=="xss.com"){alert(57)}
if (new URL("javascriptA://xss.com").host=="xss.com"){alert(65)}
if (new URL("javascriptB://xss.com").host=="xss.com"){alert(66)}
if (new URL("javascriptC://xss.com").host=="xss.com"){alert(67)}
if (new URL("javascriptD://xss.com").host=="xss.com"){alert(68)}
if (new URL("javascriptE://xss.com").host=="xss.com"){alert(69)}
if (new URL("javascriptF://xss.com").host=="xss.com"){alert(70)}

Fuzz results

Safari logo
Safari 19.0 desktop macOS 10.15.7

Updated

Mon Jul 21 2025
Found 67 results
Loading...
Firefox logo
Firefox 142.0 desktop macOS 10.15

Updated

Fri Aug 01 2025
Found 65 results
Loading...
Chrome logo
Chrome 138.0.0.0 desktop Windows NT 10.0

Updated

Mon Aug 04 2025
Found 67 results
Loading...
Firefox logo
Firefox 141.0 desktop Linux Unknown

Updated

Sat Aug 16 2025
Found 65 results
Loading...
Firefox logo
Firefox 141.0 desktop Windows NT 10.0

Updated

Mon Aug 18 2025
Found 65 results
Loading...
Chrome logo
Chrome 139.0.0.0 desktop macOS 10.15.7

Updated

Thu Aug 21 2025
Found 67 results
Loading...