Skip to content

Instantly share code, notes, and snippets.

@azu
Last active August 25, 2025 21:15
Show Gist options
  • Save azu/5dbbe70c27c2cdcd9872c5740fc7331d to your computer and use it in GitHub Desktop.
Save azu/5dbbe70c27c2cdcd9872c5740fc7331d to your computer and use it in GitHub Desktop.
<a href=javascript:alert(1) traget=_blank>XSS</a> behavior in modern browser.

Almost browsers prevent to XSS that is using javascript: protocol.

<a href=javascript:alert(location.origin) traget=_blank>XSS</a>

Demo: https://nuvjcp.csb.app/

Summary

Brower Work? Detail
Chrome No about:blank#blocked
Microsoft Edge(Chromium) No about:blank#blocked
Firefox Yes location.origin is null. It is safe.
Safari No
Mobile Safari No Show warning dialog
@netfuzzerr
Copy link

netfuzzerr commented Aug 25, 2025

This attack scenario doesn't seem to work in any modern browser. It doesn't work on Firefox anymore(still works in version 141 via CTRL+CLICK, but was patched in 142). It doesn't work in Safari 18(latest version to date) as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment