Target Storybook:storybook.busuu.com Vulnerable API:api.busuu.com (CORS allows storybook.busuu.com with credentials) Vector: postMessage → updateStoryArgs → href="javascript:..." → 1-click XSS Chain: XSS on storybook.busuu.com → fetch api.busuu.com/graphql with credentials → steal email, name, phone, city, subscription Impact: Full PII disclosure of any Busuu user who clicks the link