Coinbase Storybook DOM XSS → Account Takeover

XSS target: cds-storybook.coinbase.com (Coinbase Design System Storybook)

Technique: React element injection via updateStoryArgs postMessage — $$typeof: Symbol.for('react.transitional.element') renders attacker-controlled <iframe srcDoc>

Interaction: 0-click — XSS fires automatically when victim visits attacker page

CSP: None on Storybook — full document.cookie + fetch() access

ATO chain: cookie theft (coinbase_device_id, client_oidc_nonce) + cookie tossing to .coinbase.com + credential phishing on trusted *.coinbase.com domain