This can be done. Google Search is doing it, which can be seen when you hover over a Google link, the status bar shows the underlying site:
Yet when you click it, it brings you to a location and user-agent dependent url that looks like https://www.google.com.sg/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CC8QFjAAahUKEwi4lP-Z4_rIAhVLk5QKHXRLAe8&url=https%3A%2F%2Fwww.example.com%2F&usg=AFQjCNFEbIRqDC65KFpmuak0aXKmnzjKVQ&bvm=bv.106923889,d.dGo
. The url does Google tracking and whatnot before redirecting you to https://www.example.com
. You can easily test this using Network Inspector with "preserve log".
They're using a hacky hack but it works across all browsers.
The trick is to realize that we can set the status bar to almost anything using only HTLM's a href
(no CSS nor JavaScript needed). All we need is to trick the browser's parser into thinking that the href
value is a valid url and it will display it.
Try running this snippet:
<a href="http://.# this is p?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????owerful because ━Σ(?Д?|||)━ symbols !@)(*#&$^%</even htlm> or lorem ipsum in all scripts Лорем ипсум Lorem存有 ??????????????? ?????? Дома ?????? ????? ?????????Лорем ипсум?????? ????????? ?????? ??????? ??? ???? ?????????? ?????? Forsíea Loremのイプサム ?????? ???????? ? lorem ipsum? ?????????? ???? ???????">Hover this link (do not click) and observe the browser's status bar.</a>
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…