Shazzer logo

Characters allowed in between @import

Chrome logo 1
Firefox logo 1
Edge logo 1
Safari logo 1

Characters allowed in between @import

bribes
Created bybribes
Created Oct 19, 2025
Updated Oct 19, 2025

Tweet
Detecting browser...
CategoryCSS Parsing
VisibilityPublic
TypeXSS
CharsetUTF-8
Template used:
<style>0D⟧
@import$[chr]'//91e7358bc4c4.ngrok-free.app/test.css'0D⟧
</style>0x0D
<div id=x>test</div>0x0D
Code used after fuzz:
window.getComputedStyle(x).color === 'rgb(255, 0, 0)' && log($[i])

Fuzz results

Chrome logo
Chrome 145.0.0.0 desktop Windows NT 10.0
Updated16 Feb 2026
Found 1 result
Loading...
Firefox logo
Firefox 148.0 desktop Windows NT 10.0
Updated16 Feb 2026
Found 1 result
Loading...
Edge logo
Microsoft Edge 145.0.0.0 desktop Windows NT 10.0
Updated16 Feb 2026
Found 1 result
Loading...
Safari logo
Safari 26.2 desktop macOS 10.15.7
Updated31 Jan 2026
Found 1 result
Loading...