This sort of thing is sometimes used in so-called "scriptless xss" attacks, where if you can force the website to have an unclosed url, you can capture part of

This sort of thing is sometimes used in so-called "scriptless xss" attacks, where if you can force the website to have an unclosed url, you can capture part of the page contents (hopefully containing secrets) and exfiltrate it. To the point where chrome stopped allowing newlines in some circumstances https://chromestatus.com/feature/5735596811091968 https://chromestatus.com/feature/5735596811091968