i found a bug in your browser
with this bug the attacker can inject payload or html & js scripts
the vulnerable link is :
data:text/html,*********

we all say that js runs in data urls but this running is dangerous it's a special case...

-POC of xss :  data:text/html,<script>alert(1)</script>


-POC of open redirecting : data:text/html,<script>location.replace("https://google.com")</script>

-POC of html injection : data:text/html,html source code of google.com (it is long, and this can too be a scam source code)

html exploit exemple : <a href="data:text/html,************">new offer!!</a>