Storybook DOM XSS → Account Takeover

Target: cds-storybook.coinbase.com → coinbase.com
Storybook story: components-tooltip-tooltipcontent--default
XSS vector: postMessage → updateStoryArgs → React element revival ($$typeof: Symbol.for('react.transitional.element')) → iframe[srcDoc]
ATO chain: XSS → OAuth implicit flow (token in fragment) → API access (ACAO:*) → full account takeover
Interaction: 1-click (victim opens this page while logged into Coinbase)