Smashing...

Characters before CSS property values

This vector shows which characters are allowed before a CSS property value

Shazzer Master

Created byhackvertor

Created Aug 25, 2026

Updated Aug 25, 2026

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<div id=x style="color:$[chr]red">test</div>0x0D

Code used after fuzz:

window.getComputedStyle(x).color === 'rgb(255, 0, 0)' && log($[i])

Sample payloads

<div id=x style="color:⟦09⟧red">test</div>0x0D

<div id=x style="color:
red">test</div>0x0D

<div id=x style="color:⟦0C⟧red">test</div>0x0D

<div id=x style="color:⟦0D⟧red">test</div>0x0D

<div id=x style="color: red">test</div>0x0D

<div id=x style="color:\red">test</div>0x0D