Storybook XSS → CORS → PII Theft

Target Storybook: storybook.busuu.com
Vulnerable API: api.busuu.com (CORS allows storybook.busuu.com with credentials)
Vector: postMessage → updateStoryArgs → href="javascript:..." → 1-click XSS
Chain: XSS on storybook.busuu.com → fetch api.busuu.com/graphql with credentials → steal email, name, phone, city, subscription
Impact: Full PII disclosure of any Busuu user who clicks the link

Stolen User Data