Preliminary research

Two Bypasses for Chrome's Sanitizer API

Adam Kues and @searchlightsec · Searchlight Cyber · 22 May 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Two ways past Chrome's built-in Sanitizer API, including a javascript: URL that survives sanitisation because a U+2028 line separator splits the scheme token the parser checks against the one it later resolves.

Record

Researcher

Adam Kues and @searchlightsec

Published by

Searchlight Cyber

Date

22 May 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• sanitizer-bypass
• xss
• filter-bypass
• url-parsing
• unicode
• dom
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Adam Kues and @searchlightsec, first published at the original source. Preserved copies are kept so the citation survives its host.