Reducing...

Characters allowed begin from a forward slash character in javascript protocol - Shazzer

Characters allowed begin from a forward slash character in javascript protocol

Fuzz if window.location.href = `/${user_input}`; can redirect to javascript pseudo protocol.

Novice Fuzzer

Created bysiunam321

The fuzzing network isn't running this vector

Reported as broken by 3 engines (Blink, Gecko, WebKit) with no successful result. Editing the template, init or after code, type, charset or data references puts it back on the network.

Created Oct 28, 2025

Updated Aug 13, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

const url = new URL(`/${String.fromCodePoint($[i])}javascript:alert(origin)`);0x0D
if (url.protocol === 'javascript:') {0x0D
    log($[i]);0x0D
}

Sample payloads

const url = new URL(`/${String.fromCodePoint(0)}javascript:alert(origin)`);0x0D
if (url.protocol === 'javascript:') {0x0D
    alert(0);0x0D
}

Distributed Fuzzing

Characters allowed begin from a forward slash character in javascript protocol

Sample payloads

Fuzz results