Preliminary research

Site-DOM-XSS using Cookie Injection: The AI Hackers are Coming Faster than You Think

Renwa · Renwa

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Connects a TikTok analytics cookie writer to an OAuth script-host sink using a space-based cookie parser. URL decoding turns a plus into a space inside an unencoded cookie value, allowing a pseudo-cookie to supply base_domain and redirect a script load without controlling the actual cookie name or requiring subdomain XSS.

Record

Researcher

Renwa

Published by

Renwa

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• cookie
• dom
• xss
• url-parsing
• oauth
• attack-chain
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Renwa, first published at the original source. Preserved copies are kept so the citation survives its host.