Characters allowed in between @import
1
1
1Characters allowed in between @import
Created by: bribes
Created on: Sunday, October 19, 2025 at 5:19:50 PM
Updated on: Sunday, October 19, 2025 at 5:20:37 PM
Category: CSS Parsing
Vector visibility: Public
Vector type: XSS
Vector charset: UTF-8
Template used:
<style>⟦0D⟧
@import$[chr]'//91e7358bc4c4.ngrok-free.app/test.css'⟦0D⟧
</style>0x0D
<div id=x>test</div>0x0D
Code used after fuzz:
window.getComputedStyle(x).color === 'rgb(255, 0, 0)' && log($[i])Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
<style>⟦0D⟧
@import⟦00⟧'//91e7358bc4c4.ngrok-free.app/test.css'⟦0D⟧
</style>0x0D
<div id=x>test</div>0x0D
Fuzz results
Chrome 144.0.0.0 desktop macOS 10.15.7
Updated
Sun Jan 25 2026
Found 1 result
Loading...
Firefox 147.0 desktop macOS 10.15
Updated
Sun Jan 25 2026
Found 1 result
Loading...
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0
Updated
Mon Jan 26 2026
Found 1 result
Loading...