Collected research

Bugs in the Browser: Firefox's DATA URL Scheme Vulnerability

Bugs In The Browser Firefox's DATA URL Scheme Vulnerability

pdp · gnucitizen.org

Firefox gives a data: URL the origin of the page that opened it, exactly as it does javascript:, so a base64 data:text/html link posted to a site that only blacklists javascript: yields XSS in that site's origin. pdp shows the one-line anchor proof, notes extensions handling URLs can be pushed to chrome privileges, and argues for scheme whitelisting.

Record

Document

Bugs In The Browser Firefox's DATA URL Scheme Vulnerability

Researcher

pdp

Published by

gnucitizen.org

Topic

Browser

In the archive

• Collected in the 2007 research round

Tags

• xss
• sop-bypass
• same-origin-policy
• filter-bypass
• url-parsing
• javascript
• sandbox-escape
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of pdp, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.