Root from the parking lot: OpenWrt XSS through SSID scanning (CVE-2026-32721)

Lately, I&rsquo;ve been experimenting with unusual XSS vectors. XSS (cross-site scripting) allows an attacker to execute arbitrary javascript in another user&rsquo;s browser session. Sometimes the result is merely entertaining, sometimes the result is: Dear Sasha, excellent (and terrible) find! A crafted wifi SSID could lead to an XSS in the OpenWrt admin interface, if an admin opened the nearby…