Entities after protocol-relative URL
Tests which entities are allowed after a protocol-relative URL
Created byhackvertor
Created Apr 3, 2026
Updated Apr 3, 2026
Detecting browser...
CategoryEntity Parsing
VisibilityPublic
TypeJS
CharsetUTF-8
$[data1] placeholderhtml_entities
Code used before fuzz:
const div = document.createElement('div')Template used:
div.innerHTML='<a href="//$[data1]example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
log('$[data1]');0x0D
}Sample payloads
div.innerHTML='<a href="//⁡example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁡');0x0D
}div.innerHTML='<a href="//⁡example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁡');0x0D
}div.innerHTML='<a href="//\example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('\');0x0D
}div.innerHTML='<a href="//@example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('@');0x0D
}div.innerHTML='<a href="//⁣example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁣');0x0D
}div.innerHTML='<a href="//⁣example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁣');0x0D
}div.innerHTML='<a href="//⁢example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁢');0x0D
}div.innerHTML='<a href="//⁢example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁢');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//
example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('
');0x0D
}div.innerHTML='<a href="//⁠example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁠');0x0D
}div.innerHTML='<a href="//­example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('­');0x0D
}div.innerHTML='<a href="///example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('/');0x0D
}div.innerHTML='<a href="//	example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('	');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//‍example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('‍');0x0D
}div.innerHTML='<a href="//‌example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('‌');0x0D
}Fuzz results
Chrome 147.0.0.0 desktop macOS 10.15.7
Updated5 Apr 2026
Found 18 results
Loading...
Chrome 146.0.0.0 desktop Windows NT 10.0older version
Updated4 Apr 2026
Found 18 results
Loading...
Chrome 146.0.0.0 mobile Android 10older version
Updated4 Apr 2026
Found 18 results
Loading...
Chrome 146.0.0.0 desktop Linux Unknownolder version
Updated8 Apr 2026
Found 18 results
Loading...
Chrome 104.0.0.0 mobile Android 13older version
Updated4 Apr 2026
Found 14 results
Loading...
Firefox 150.0 desktop Windows NT 10.0
Updated5 Apr 2026
Found 18 results
Loading...
Firefox 149.0 desktop macOS 10.15older version
Updated3 Apr 2026
Found 18 results
Loading...
Firefox 145.0 desktop Linux Unknownolder version
Updated5 Apr 2026
Found 18 results
Loading...
Microsoft Edge 146.0.0.0 desktop Windows NT 10.0
Updated6 Apr 2026
Found 18 results
Loading...
Safari 26.4 mobile iOS 18.7
Updated3 Apr 2026
Found 18 results
Loading...
Safari 26.3.1 desktop macOS 10.15.7older version
Updated6 Apr 2026
Found 18 results
Loading...
Safari 26.0 mobile iOS 18.6older version
Updated4 Apr 2026
Found 18 results
Loading...