emarketer.com — DOM XSS + CORS Chain

Target: www.emarketer.com/advertise/
Vulnerable component: Inline message event listener (Ceros form handler)
Sink: window.location.href = event.data.url — no origin check, no scheme check
CSP: None
Impact: XSS + read cookies + same-origin APIs + CORS chain to contentp13n API

Step 1: Open www.emarketer.com/advertise/ in popup (X-Frame-Options: DENY blocks iframe)
Step 2: Send postMessage({type: "formSubmitted", url: "javascript:..."})
Step 3: Handler assigns javascript: URL to window.location.href — JS executes
Step 4: Read cookies, DOM, probe same-origin + CORS APIs

emarketer.com — DOM XSS + CORS Chain

Stolen Data