Read the researcher's report on HackerOne
The report alleges that some responses omit Content Security Policy headers for unsupported browsers, and that a CDN may cache those responses. It does not describe an exploit or demonstrate that this enables cross-site scripting.
How it was found
- The researcher noticed inconsistent CSP headers across browser responses.
- They observed or suspected that a response without CSP could be cached by the CDN.
- They linked this behavior to increased XSS risk, without reporting a confirming test.
- Access needed
- No account
- User interaction
- Not clear
- Whose object
- No object involved
- Boundary crossed
- No decisive security boundary crossing is demonstrated.
- Root cause
- CSP header delivery may vary by browser, allowing a response without the policy to be cached and served more broadly.
- Impact
- Cached responses without CSP could reduce a defense-in-depth barrier against XSS, but no exploitable XSS or affected users are established.
- Components
- HTTP response headers, content security policy, CDN cache
- Confidence
- low
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-15. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure | No account | The attacker's own | A crafted deeplink caused the app's privileged webview to disclose its user's data to attacker-controlled content. |
| Email templates XSS by filterXSS bypass | A user account | Another user's | A crafted template preview crossed into another user's authenticated context, enabling access to private content and account credentials. |
| XSS vulnerable parameter in a location hash | No account | No object involved | A crafted link could cause script execution in a victim’s site context. |
| [accounts.reddit.com] Redirect parameter allows for XSS | No account | No object involved | A crafted redirect destination caused script execution in the account site’s browser context. |
| yelp.com XSS ATO (via login keylogger, link Google account) | No account | Another user's | A crafted link causes script to run in a victim’s Yelp session and link an attacker-controlled identity to the victim’s account. |
| XSS at jamfpro.shopifycloud.com | No account | No object involved | A crafted link caused attacker-controlled script to execute in the application origin. |
| Stored XSS in developer.uber.com | A user account | No object involved | A contributor’s stored suggestion executes in an administrator’s dashboard context. |
| [www.zomato.com] Blind XSS on one of the Admin Dashboard | A user account | The attacker's own | Customer-submitted order content executed in an administrator's browser. |
| Account Takeover in Periscope TV | No account | Another user's | OAuth authorization data for a victim was sent to an attacker-controlled destination. |
| XSS and cache poisoning via upload.twitter.com on ton.twitter.com | A user account | Another tenant's | A signed upload made an attacker-controlled file viewable by another user in the target origin. |
| XSS at https://exchangemarketplace.com/blogsearch | No account | No object involved | Untrusted search input was interpreted as script in the site's page. |
| xss on https://www.rockstargames.com/GTAOnline/jp/screens/ | No account | No object involved | Untrusted path content was treated as executable script in a visitor's browser. |