Hacking...

Characters allowed begin from a forward slash character in javascript protocol

Fuzz if window.location.href = `/${user_input}`; can redirect to javascript pseudo protocol.

Novice Fuzzer

Created bysiunam321

The fuzzing network isn't running this vector

Reported as broken by 3 engines (Blink, Gecko, WebKit) with no successful result. Editing the template, init or after code, type, charset or data references puts it back on the network.

Created Oct 28, 2025

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

const url = new URL(`/${String.fromCodePoint($[i])}javascript:alert(origin)`);
if (url.protocol === 'javascript:') {
    log($[i]);
}