ATTACKER-CONTROLLED PAGE — unrelated third-party origin — HackerOne hidalg0d
#
step
expected
verdict
observed
iframe A: webchat /chat
iframe B: app.moveworks.ai ?mode=webchat