[airbnb.com] XSS via Cookie flash

Summary

By corrupting the value of a cookie on the airbnb.com domain, bobrov was able to execute an XSS payload. Because cookies cannot be set cross-domain, this did require another vulnerability to be exploitable. Furthermore, because of CSP, this was only exploitable in Internet Explorer 11. The issue was fixed with enhanced output encoding.

Thanks to bobrov for this well-documented finding!