Read the researcher's report on HackerOne
A crafted Direct Message deeplink reportedly caused attacker-controlled HTML to appear on the messaging origin. The report says the content security policy blocked JavaScript execution, so successful script-based XSS was not demonstrated.
How it was found
- Reviewed the documented Direct Message deeplink flow.
- Placed encoded markup in the deeplink’s text parameter and shared the link in a post.
- Observed HTML injection on the messaging origin; the report notes CSP prevented script execution.
- Access needed
- A user account · an account
- User interaction
- Needed
- Whose object
- No object involved
- Boundary crossed
- Untrusted deeplink text was rendered as HTML in the messaging origin.
- Root cause
- The deeplink’s text parameter was rendered as HTML without sufficient contextual escaping.
- Impact
- Injected HTML could support phishing or deanonymization, while arbitrary JavaScript execution was not confirmed.
- Payload class
- Encoded HTML markup with an SVG event-handler attribute
- Components
- Direct Message deeplink, message composer
- Confidence
- medium
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Cross-site Scripting (XSS) on HackerOne careers page | No account | No object involved | A crafted careers-page URL caused attacker-controlled query data to enter rendered page markup. |
| Lynxview JS interfaces Takeover via deeplink traversal | Not clear from the report | No object involved | Deep-link navigation reached JavaScript interfaces exposed to WebView content. |
| Possible DOM XSS on app.hey.com | A user account | The attacker's own | Email subject content crossed into search-result rendering as HTML. |
| DOM based CSS Injection on grammarly.com | No account | No object involved | A visitor's browser loaded attacker-controlled CSS into the target page. |
| DOM Based XSS in mycrypto.com | No account | No object involved | URL-fragment input crossed into rendered page content without encoding. |
| CSS Injection on /embed/ via bgcolor parameter leaks user's CSRF token and allows for XSS | No account | No object involved | A crafted embed URL causes attacker-controlled CSS to be interpreted in the page. |
| XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter | No account | No object involved | Attacker-controlled external shop data crossed into the trusted widget rendering context and executed script. |
| HTML injection in title of reader view | No account | No object involved | Page-controlled title content crossed into the browser's trusted Reader Mode rendering context. |
| com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover | A user account | The attacker's own | Injected WebView content accessed native-bridged account data and sent it outside the app. |
| Self XSS when pasting HTML into Text app with Ctrl+Shift+V | A user account | The attacker's own | User-controlled clipboard content was interpreted as HTML in the editor page. |
| DOM Based XSS in www.hackerone.com via PostMessage | No account | No object involved | A forged cross-window message controlled the contact page's post-submission redirect. |
| Stored XSS on TikTok Ads | Not clear from the report | No object involved | Potentially crossed from uploaded SVG content into script execution in a viewer's browser. |