Critical — DOM XSS + Cookie Theft

Storybook postMessage XSS → .priceline.com Cookie Exfiltration

No origin check on updateStoryArgs allows arbitrary JavaScript execution on horizon.corp.priceline.com, leaking session tokens and PII from the .priceline.com domain.

Target: horizon.corp.priceline.com
Sink: A (Link) href=javascript: via Storybook postMessage
Root Cause: Storybook channel accepts updateStoryArgs from any origin
Impact: Exfiltrate all non-HttpOnly .priceline.com cookies (session IDs, PII, anti-fraud tokens) + credentialed CORS to ids.priceline.com
Interaction: 1 click (victim clicks link in Storybook popup)

Reproduction steps:

Sign in to www.priceline.com in this browser
Click one of the buttons below
In the popup, click CLICK HERE

Output

Ready. Click a button above to start the PoC.