Is there any way to load html data uri:


with this scheme:


i have seen this payload going around:


But only shows as text plain, on latest Chrome / Firefox

Mozzila Firefox ESR latest -> prompts download


Doing this directly in the searchbar won't work, it must to be activated from the source code.

By introducing a newline right in the middle of the protocol handler, we can make sure that blacklists looking for javascript: and data: as well as other possibly malicious handlers will not detect anything bad, and probably will allow submission. The only browsers not allowing this kind of obfuscation are Firefox and Gecko-based user agents. Since it's allowed to use the canonical form of the newline.

Practically you can manipulate the handler by using hex-chars to replace with some chars in the current payload.

The "a" in this payload is actually hardcoded in hex, between "d" and "t", then using the content type text/html for displaying it, also the a's next are in hex:

<a href="
        <scr&#x69pt>alert('Gstuff')</scr&#x69pt>">click me</a>

The code above will result in a valid XSS, tested in Safari 12.11


  • Thanks, learned something new! :-) Well unfortunately for me, I can only use foobar:// uri scheme expect javascript word, and was thinking I can do this with data://, I just looked and you are right. php.net/manual/en/wrappers.data.php – SecurityQuy Aug 1 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.