Preliminary research

Multiple cross-site leaks disclosing Facebook users in third-party websites

Youssef Sammouda · Youssef Sammouda (sam0) personal blog · 16 January 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Documents four Facebook cross-site leaks using CORB content-type behavior, framing and postMessage responses, employee-subdomain probes, and a script gadget. Preconditioning JavaScript prototypes before loading `signals/iwl.js` directly discloses the current Facebook user ID to another origin.

Record

Researcher

Youssef Sammouda

Published by

Youssef Sammouda (sam0) personal blog

Date

16 January 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• xsleak
• corb
• postmessage
• iframe
• javascript
• info-leak
• same-origin-policy
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Youssef Sammouda, first published at the original source. Preserved copies are kept so the citation survives its host.