Entities after protocol-relative URL
Tests which entities are allowed after a protocol-relative URL
Created byhackvertor
Created Apr 3, 2026
Updated Apr 3, 2026
Detecting browser...
CategoryEntity Parsing
VisibilityPublic
TypeJS
CharsetUTF-8
$[data1] placeholderhtml_entities
Code used before fuzz:
const div = document.createElement('div')Template used:
div.innerHTML='<a href="//$[data1]example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
log('$[data1]');0x0D
}Sample payloads
div.innerHTML='<a href="//⁡example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁡');0x0D
}div.innerHTML='<a href="//⁡example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁡');0x0D
}div.innerHTML='<a href="//\example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('\');0x0D
}div.innerHTML='<a href="//@example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('@');0x0D
}div.innerHTML='<a href="//⁣example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁣');0x0D
}div.innerHTML='<a href="//⁣example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁣');0x0D
}div.innerHTML='<a href="//⁢example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁢');0x0D
}div.innerHTML='<a href="//⁢example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁢');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}div.innerHTML='<a href="//
example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('
');0x0D
}div.innerHTML='<a href="//⁠example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('⁠');0x0D
}div.innerHTML='<a href="//­example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('­');0x0D
}div.innerHTML='<a href="///example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('/');0x0D
}div.innerHTML='<a href="//	example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('	');0x0D
}div.innerHTML='<a href="//​example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
alert('​');0x0D
}Fuzz results
Chrome 146.0.0.0 mobile Android 10
Updated3 Apr 2026
Found 18 results
Loading...
Chrome 146.0.0.0 desktop macOS 10.15.7
Updated3 Apr 2026
Found 18 results
Loading...
Chrome 144.0.0.0 desktop Linux Unknownolder version
Updated3 Apr 2026
Found 18 results
Loading...
Firefox 149.0 desktop macOS 10.15
Updated3 Apr 2026
Found 18 results
Loading...
Safari 26.3.1 desktop macOS 10.15.7
Updated3 Apr 2026
Found 18 results
Loading...