javascript in meta tag not working on firefox and internet explorer

Question

I noticed this:

<meta HTTP-EQUIV="REFRESH" CONTENT="0;URL=javascript:alert(2)">

Only works on chrome, so my question is, how can I execute JavaScript within a meta tag that will work on chrome, firefox and internet explorer? As far as my tests have gone, that only works in chrome and not on internet explorer and firefox.

Answer 1

javascript: URIs where disabled in Firefox via MSFA 2009-22 / CVE-2009-1312 . I guess Internet Explorer disables such URIs for the same reason.

Hence you cannot use javascript: URIs for meta-refresh. Of course you're still free to do something like:

<script>
  setTimeout(function() { alert(2); }, 0);
  // or just
  alert(2);
</script>