Characters allowed in between // in absolute URL

Created by: bribes

Created on: Saturday, November 29, 2025 at 3:38:51 AM

Updated on: Saturday, November 29, 2025 at 3:38:51 AM

Category: URL Handling

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:

let chr = String.fromCodePoint($[i]);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && log($[i])

Your browser was detected as:

Detecting... Detecting... Detecting... Detecting...

Sample payloads

let chr = String.fromCodePoint(0);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(0)

Characters allowed in between // in absolute URL

Sample payloads

Fuzz results

Distributed Fuzzing