A data: URL href can embed arbitrary HTML and scripts. A crawl service should not follow or render this as a trusted page.
Collector Log
Activating the link below sends a hit to /collect/. It appears here (auto-refreshes every 2 s).
No hits yet.
This link opens a data: URL whose HTML payload contains a script. Clicking it loads the data URL in the browser and the embedded script runs.