Concealing payloads in URL credentials
Summary: PortSwigger researcher Gareth Heyes documented that payloads can be concealed in the credentials portion of a URL, which is hidden from the address bar in both Chrome and Firefox and persists through same-origin navigations. Heyes found that document.URL retains the credentials part while location does not, that Firefox does not URL-encode single quotes in credentials, and that this can be used to control the username and password properties of anchor elements and combine with DOM clobbering; Safari discards URL credentials and Chrome blocks sub-resources from using them.
Bottom line: The payload sits in a part of the URL that neither Chrome nor Firefox shows the user, and document.URL still exposes it to JavaScript, so a DOM XSS filter that only inspects the query string and hash can miss it entirely.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026