A smorgasbord of a bug chain: postMessage, JSONP, WAF bypass, XSS, CORS, CSRF
jub0bs.com