Characters that break CSS dangling strings

This vector shows which characters create a new selector if there is a dangling CSS string

Shazzer Master

Created Aug 6, 2026

Updated Aug 6, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<style>0x0D
.x{⟦0D⟧
   font-family:"foo, bar, baz$[chr]}.x{color:red;⟦0D⟧
}⟦0D⟧
</style>0x0D
<div id=x class="x">test</div>0x0D

Code used after fuzz:

window.getComputedStyle(x).color === 'rgb(255, 0, 0)' && log($[i])

Sample payloads

<style>0x0D
.x{⟦0D⟧
   font-family:"foo, bar, baz
}.x{color:red;⟦0D⟧
}⟦0D⟧
</style>0x0D
<div id=x class="x">test</div>0x0D

<style>0x0D
.x{⟦0D⟧
   font-family:"foo, bar, baz⟦0C⟧}.x{color:red;⟦0D⟧
}⟦0D⟧
</style>0x0D
<div id=x class="x">test</div>0x0D

<style>0x0D
.x{⟦0D⟧
   font-family:"foo, bar, baz⟦0D⟧}.x{color:red;⟦0D⟧
}⟦0D⟧
</style>0x0D
<div id=x class="x">test</div>0x0D

<style>0x0D
.x{⟦0D⟧
   font-family:"foo, bar, baz"}.x{color:red;⟦0D⟧
}⟦0D⟧
</style>0x0D
<div id=x class="x">test</div>0x0D