Q:

data:// uri XSS - using wrappers

Is there any way to load html data uri:

data:text/html,<html><svg/onload=confirm(1)></html>

with this scheme:

data://

i have seen this payload going around:

data://text/javascript,alert(1)

But only shows as text plain, on latest Chrome / Firefox
Mozzila Firefox ESR latest -> prompts download

A:

Doing this directly in the searchbar won't work, it must to be activated from the source code.
By introducing a newline right in the middle of the protocol handler, we can make sure that blacklists looking for javascript: and data: as well as other possibly malicious handlers will not detect anything bad, and probably will allow submission. The only browsers not allowing this kind of obfuscation are Firefox and Gecko-based user agents. Since it's allowed to use the canonical form of the newline.
Practically you can manipulate the handler by using hex-chars to replace with some chars in the current payload.
The "a" in this payload is actually hardcoded in hex, between "d" and "t", then using the content type text/html for displaying it, also the a's next are in hex:  
<a href="
        d
        &#x61
        t
        &#x61
        :text/html,
        <scr&#x69pt>alert('Gstuff')</scr&#x69pt>">click me</a>

The code above will result in a valid XSS, tested in Safari 12.11
https://i.stack.imgur.com/aPJox.png

