Taking advantage of a long-lost HTML tag (<plaintext>) that tells the parser to switch the tokenizer to "PLAINTEXT" state[0] with no escape: javascript:doc

Taking advantage of a long-lost HTML tag (<plaintext>) that tells the parser to switch the tokenizer to "PLAINTEXT" state[0] with no escape: javascript:document.body.innerHTML="<plaintext>"+document.body.innerHTML From MDN[1]: > The <plaintext> HTML element renders everything following the start tag as raw text, ignoring any following HTML. There is no closing tag, since everything after it is considered raw text. You could use the <pre> tag, but that can be "escaped" from if a </pre> tag exists on the page. Escaping the angle brackets with < and > would fix it, but <plaintext> is more elegant IMO. [0]: https://html.spec.whatwg.org/#plaintext-state https://html.spec.whatwg.org/#plaintext-state [1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/plaintext https://developer.mozilla.org/en-US/docs/Web/HTML/Element/pl...