Characters allowed inside javascript protocol and still returns the hostname

Chrome logo 67
Safari logo 67
Firefox logo 65

want to test if new URL('javascript://xss.com') can still return the hostname on all characters

Created by: RenwaX23

Created on: Monday, July 21, 2025 at 8:36:05 AM

Updated on: Monday, July 21, 2025 at 8:36:05 AM


Vector type: JS

Vector charset: UTF-8

Template used:
if (new URL("javascript$[chr]://xss.com").host=="xss.com"){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

if (new URL("javascript	://xss.com").host=="xss.com"){alert(9)}
if (new URL("javascript+://xss.com").host=="xss.com"){alert(43)}
if (new URL("javascript-://xss.com").host=="xss.com"){alert(45)}
if (new URL("javascript.://xss.com").host=="xss.com"){alert(46)}
if (new URL("javascript0://xss.com").host=="xss.com"){alert(48)}
if (new URL("javascript1://xss.com").host=="xss.com"){alert(49)}
if (new URL("javascript2://xss.com").host=="xss.com"){alert(50)}
if (new URL("javascript3://xss.com").host=="xss.com"){alert(51)}
if (new URL("javascript4://xss.com").host=="xss.com"){alert(52)}
if (new URL("javascript5://xss.com").host=="xss.com"){alert(53)}
if (new URL("javascript6://xss.com").host=="xss.com"){alert(54)}
if (new URL("javascript7://xss.com").host=="xss.com"){alert(55)}
if (new URL("javascript8://xss.com").host=="xss.com"){alert(56)}
if (new URL("javascript9://xss.com").host=="xss.com"){alert(57)}
if (new URL("javascriptA://xss.com").host=="xss.com"){alert(65)}
if (new URL("javascriptB://xss.com").host=="xss.com"){alert(66)}
if (new URL("javascriptC://xss.com").host=="xss.com"){alert(67)}
if (new URL("javascriptD://xss.com").host=="xss.com"){alert(68)}
if (new URL("javascriptE://xss.com").host=="xss.com"){alert(69)}
if (new URL("javascriptF://xss.com").host=="xss.com"){alert(70)}

Fuzz results

Chrome logo
Chrome 138.0.0.0 desktop macOS 10.15.7

Updated

Mon Jul 21 2025
Found 67 results
Loading...
Safari logo
Safari 19.0 desktop macOS 10.15.7

Updated

Mon Jul 21 2025
Found 67 results
Loading...
Chrome logo
Chrome 138.0.0.0 desktop Windows NT 10.0

Updated

Mon Jul 21 2025
Found 67 results
Loading...
Firefox logo
Firefox 140.0 desktop macOS 10.15

Updated

Mon Jul 21 2025
Found 65 results
Loading...