Additional Restricted Characters vectors utilizing Javascript Event handlers

[0x999-x]

Hello👋

I'd like to propose the addition of a few new vectors to the Restricted Characters section of the XSS cheat sheet, specifically ones utilizing various Javascript event handlers and require no user interaction.

The tables below showcase several Javascript event handlers that can be fired using a restricted set of characters and require no user interaction, additionally it demonstrates how these event handlers can be used to achieve arbitrary Javascript execution by overriding the Event object's inherited toString function using 2 different methods.

The first method uses Arrow functions (requires a > character) e.g: Event.prototype.toString=x=>'x' results in x

The second method inspired by @terjanq overwrites the Event object's toString function with the toString function of another Object that has writeable and reflected properties (name/message properties for any of the Error Objects & flags/source properties for the Regex Object as shown in @terjanq's post.

Regex object example: Event.prototype.toString=/x/.toString;Event.prototype.flags='x';Event.prototype.source='x' results in /x/x
Error object example: Event.prototype.toString=Error.prototype.toString;Event.prototype.message='x';Event.prototype.name='x' results in x: x

ondevicemotion & URIError object
ondeviceorientation & Error object
ondeviceorientationabsolute & WebTransportError object
onpagereveal & AggregateError object
onpageswap & EvalError object (requires focus when the redirection occurs)

onmessage & RangeError object (requires iframe or top level navigation)
onhashchange & Regex object
onscroll & ReferenceError object
onscrollend & SyntaxError object
onselect & TypeError object
ontransitionstart / ontransitionend / ontransitionrun & Arrow function
onload & DOMException object
onpageshow & WebTransportError object

Additionally I noticed that this vector which utilizes the onerror event handler and doesn't require a throw statement is missing from the cheat sheet, I think it might be worth adding as well.

EDIT:
In hindsight for the non-onerror events I think it'd probably make more sense to only include the Error, DOMException & Regex objects & Arrow function in the cheat sheet as they are the only uniquely worded ones and it seems like some of the other Error objects aren't supported on Safari/Chromium on mobile.

Thank you. ❤️