5 ms·

I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.

• yen223 13y ago
  See the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.
  • SomeoneWeird 13y ago
    Clever.