Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/

How it was found

Description: The website located at https://www.uber.com/ suffers from a generated Cross-site Scripting (XSS) vulnerability in the "find a city" input field.

Reproduction Steps:

Open the latest Chrome web browser

Navigate to the following URL's "find a city input field": https://www.uber.com/

Type in the following:

Note that the autocomplete result being generated from the server side is raw javascript and payload was fired.

I’ve tested this in the latest Chrome. Attached to this report are screenshots of this issue occurring in chrome.