Characters allowed as CSS variable names

⚠ Browser differences

This vector shows which characters are allowed as CSS variable names

Shazzer Master

Created Aug 6, 2026

Updated Aug 6, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div id=x style="--&#$[i]:red;color:var(--&#$[i])">test</div>

Code used after fuzz:

window.getComputedStyle(x).color === 'rgb(255, 0, 0)' && log($[i])

Sample payloads

<div id=x style="--&#0:red;color:var(--&#0)">test</div>

<div id=x style="--&#45:red;color:var(--&#45)">test</div>

<div id=x style="--&#95:red;color:var(--&#95)">test</div>