XSS Injection invalidate meta redirection tag

Question

When injecting into the url part of an HTML META redirect like this:

<meta http-equiv='refresh' content='0;URL=$URL'

where $URL (note the missing quotes) is the part I can inject, is there any way to invalidate the meta tag so it does not redirect immediately and instead run the injected JS? I already tried injecting the content attribute again with a different redirect time, but at least for chrome, this does not work.

Answer 1

Seems like using something like: javascript:alert(1); as the URL, then closing the meta tag and opening a new script tag for the XSS works.