diff --git a/Tests/LibWeb/Text/expected/regress/console-log-bogus-formatting-specifier.txt b/Tests/LibWeb/Text/expected/regress/console-log-bogus-formatting-specifier.txt
new file mode 100644
index 00000000000..23b535695b9
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/regress/console-log-bogus-formatting-specifier.txt
@@ -0,0 +1 @@
+PASS (didn't hang)
diff --git a/Tests/LibWeb/Text/input/regress/console-log-bogus-formatting-specifier.html b/Tests/LibWeb/Text/input/regress/console-log-bogus-formatting-specifier.html
new file mode 100644
index 00000000000..80a777c6377
--- /dev/null
+++ b/Tests/LibWeb/Text/input/regress/console-log-bogus-formatting-specifier.html
@@ -0,0 +1,7 @@
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        console.log("%z%z", 1, 2);
+        println("PASS (didn't hang)");
+    });
+</script>
diff --git a/Userland/Libraries/LibJS/Console.cpp b/Userland/Libraries/LibJS/Console.cpp
index 3e3c9c184a5..1fb6f1d5347 100644
--- a/Userland/Libraries/LibJS/Console.cpp
+++ b/Userland/Libraries/LibJS/Console.cpp
@@ -818,7 +818,7 @@ ThrowCompletionOr<MarkedVector<Value>> ConsoleClient::formatter(MarkedVector<Val
     auto find_specifier = [](StringView target) -> Optional<StringView> {
         size_t start_index = 0;
         while (start_index < target.length()) {
-            auto maybe_index = target.find('%');
+            auto maybe_index = target.find('%', start_index);
             if (!maybe_index.has_value())
                 return {};