This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

VULNERABILITY DETAILS
Please provide a brief explanation of the security issue.
It is possible to append javascript before https, thus it results in XSS on all websites.
javascripT://https://www.google.co.in

Complete url causing XSS JavascripT://https://www.google.co.in%0aalert(document.domain);//https://www.google.co.in

VERSION
Chrome Version:62.0.3202.94
Operating System: [Windows 8.1, 64 bit]

REPRODUCTION CASE
1. Visit https://www.google.com
2.append javascripT://   before https:// so our url will become JavascripT://https://www.google.co.in
3.Add payload %0aalert(document.domain);//https://www.google.co.in after domain name.

so now our final url will be 
JavascripT://https://www.google.co.in%0aalert(document.domain);//https://www.google.co.in

Suggested Fix:
The validator should check, that url string must strictly start with http[s]://.