Respondly · Report #7913

Import emails from Gmail are activate XSS

Validstatus

2upvotes

21 Apr 2014disclosed

How it was found

Hi,

If you choose to import your contacts via Gmail and the contact name contains JS, it will execute it.

Sasi

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original