Characters allowed inside javascript protocol and still returns the hostname

⚠ Browser differences

want to test if new URL('javascript://xss.com') can still return the hostname on all characters

Created byRenwaX23

Created Jul 21, 2025

Updated Jul 21, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL("javascript$[chr]://xss.com").host=="xss.com"){log($[i])}

Sample payloads

if (new URL("javascript0x09://xss.com").host=="xss.com"){alert(9)}

if (new URL("javascript+://xss.com").host=="xss.com"){alert(43)}

if (new URL("javascript-://xss.com").host=="xss.com"){alert(45)}

if (new URL("javascript.://xss.com").host=="xss.com"){alert(46)}

if (new URL("javascript0://xss.com").host=="xss.com"){alert(48)}

if (new URL("javascript1://xss.com").host=="xss.com"){alert(49)}

if (new URL("javascript2://xss.com").host=="xss.com"){alert(50)}

if (new URL("javascript3://xss.com").host=="xss.com"){alert(51)}

if (new URL("javascript4://xss.com").host=="xss.com"){alert(52)}

if (new URL("javascript5://xss.com").host=="xss.com"){alert(53)}

if (new URL("javascript6://xss.com").host=="xss.com"){alert(54)}

if (new URL("javascript7://xss.com").host=="xss.com"){alert(55)}

if (new URL("javascript8://xss.com").host=="xss.com"){alert(56)}

if (new URL("javascript9://xss.com").host=="xss.com"){alert(57)}

if (new URL("javascriptA://xss.com").host=="xss.com"){alert(65)}

if (new URL("javascriptB://xss.com").host=="xss.com"){alert(66)}

if (new URL("javascriptC://xss.com").host=="xss.com"){alert(67)}

if (new URL("javascriptD://xss.com").host=="xss.com"){alert(68)}

if (new URL("javascriptE://xss.com").host=="xss.com"){alert(69)}

if (new URL("javascriptF://xss.com").host=="xss.com"){alert(70)}