Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing
Summary: PortSwigger researcher Gareth Heyes built a visual fuzzer using headless Chrome and puppeteer that screenshots rendered Unicode characters and flags any that produce non-white pixels in the top, left, or bottom regions of the page. Fuzzing code points 768-879 found that character 837 combined with any character in that range produced side effects on Edge, which treats certain Unicode combining characters as whitespace, yielding Zalgo text that is also valid JavaScript.
What's compelling: Edge's treatment of combining characters as whitespace means obfuscated JavaScript can render as garbled Zalgo text while still executing, so signature and filter-based detection that assumes readable source can be bypassed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026