↓ Skip to main content
An aerial view of a motorway interchange where one carriageway splits and curves away onto a separate ramp.
Photo by Denys Nevozhai on Unsplash
  1. Research/

Chrome backslash URLs and XSS filter bypass

·2 mins
URL parsing Parser differential Filter bypass Vendor response
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

Today I reported a strange bug to the devs of the Chromium Project, look at the following lines of code:

<html>
<script src=http:\\\\\\\\\\\\attacker.example\\\\\\\\\\\\\test.js> </script>
</html>

You see those leading slashes? Do you think that this is a valid URL a Browser would process? In fact it does not look like a valid one, but for Google Chrome it is. As you can see in the picture the URL gets executed regardless of how many backslashes there were added.

Chrome loading and executing a script from a URL written as http: followed by a dozen backslashes

Proof of concept
#

Feel free to try this out on your own: serve the snippet above from a host you control and inspect the JavaScript console in Chrome, you will see that the simple JavaScript message (console.log(‘this is weird’);) has been executed. This technique also works if you only use one slash, a pretty weird scenario imho. If you check this on Firefox the URL and the corresponding JavaScript won’t get executed.

Firefox refusing to load the same backslash-prefixed script URL, with no console output from the payload

Disclosure
#

The questions arising at this point should be: Why does Google Chrome treat URLs differently to other browsers? Is this a security issue which could bypass XSS Filters? With all these question marks in my head I went over to the Chromium site and filed a new issue. Some hours later, the response from @tsepez from the Chromium team was pretty clear:

“This is one of those cases where we’ve chosen to support broken pages rather than being strict about URL syntax.”

So in other words, it’s a wontfix.

Related