postmessage 2 How one Parameter Pollution bug left many apps vulnerable to Account Takeovers Feb 1, 2024 Stealing OAuth tokens with a relative wildcard URL Sep 21, 2023