0-Click XSS + PII Disclosure via Embedded Login postMessage(*)

biome-storybook.immutable.com postMessage XSS → inject im-embedded-login-prompt iframe (no frame-ancestors) → user enters email → postMessage("*") leaks email to attacker origin → cookie toss poisons .immutable.com

1XSS Inject

2Login Embed

3PII Capture

4Cookie Toss

Storybook iframe (victim)