Preliminary research
Site-DOM-XSS using Cookie Injection: The AI Hackers are Coming Faster than You Think
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
Connects a TikTok analytics cookie writer to an OAuth script-host sink using a space-based cookie parser. URL decoding turns a plus into a space inside an unencoded cookie value, allowing a pseudo-cookie to supply base_domain and redirect a script load without controlling the actual cookie name or requiring subdomain XSS.
Record
- Researcher
- Renwa
- Published by
- Renwa
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Renwa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .