My approach to fuzzing has changed with a modern browser, I use innerHTML and DOM properties now. You have to use both because there are different results as they follow different code paths. Let’s say we want to fuzz JavaScript URLs in a modern browser, the first way is to use the DOM: