Preliminary research

Account Takeover in Facebook mobile app due to Math.random and XSS in the Facebook JS SDK

Youssef Sammouda · Youssef Sammouda (sam0) personal blog · 17 January 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Combines a Facebook JavaScript SDK postMessage DOM XSS with predictable V8 Math.random output. Observed plugin-iframe names reconstruct the PRNG state and predict an XSS callback, while mobile WebView framing and login CSRF complete account takeover.

Record

Researcher

Youssef Sammouda

Published by

Youssef Sammouda (sam0) personal blog

Date

17 January 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• javascript
• postmessage
• xss
• prng
• csrf
• webview
• account-takeover
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Youssef Sammouda, first published at the original source. Preserved copies are kept so the citation survives its host.