Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK
Facebook Javascript SDK and Facebook plugins
Youssef Sammouda (sam0) personal blog
The goal of this blog is to share write-ups about bugs i have found in Facebook and reported to them under the Facebook bug bounty program.
Latest posts
Instagram account takeover via Meta Pixel script abuse
Introduction Meta’s web ecosystem relies on cross-window messaging between first-party websites. In many cases, the only security control enforced is an origin check validating that messages originate from facebook.com or its subdomains.
Multiple cross-site leaks disclosing Facebook users in third-party websites
Introduction This write-up consolidates several XS-Leak issues discovered across Meta-owned platforms, including Facebook, Workplace, Meta for Work, and internal Meta surfaces.
Leaking Meta FXAuth Token leading to 2 click Account Takeover
Introduction FXAuth is Meta’s shared authentication system used across Facebook, Instagram, and Meta (Horizon / VR). It is used by Accounts Center for account linking, re-authentication, and sensitive action confirmation.
Two-click Facebook account takeover via FXAuth token and blob theft
Introduction Facebook and Instagram accounts are deeply integrated through Accounts Center, allowing users to link identities, share authentication methods, and manage security settings across platforms.
Self-XSS in Facebook payments flow leads to Instagram and Facebook account takeovers
Introduction Facebook’s payments and billing flows rely heavily on third-party financial service providers. To facilitate bank-based payments, Facebook embeds external services inside privileged Facebook pages and allows cross-window communication between those services and facebook.com.
Datr cookie theft and AI leads to Facebook account takeover via trusted device recovery
Introduction Facebook relies on long-lived device identifiers to reduce friction for returning users and to distinguish legitimate activity from suspicious logins. Over time, devices that repeatedly authenticate to the same account are treated as trusted, allowing Facebook to relax certain security requirements during sensitive flows such as account recovery.
Multiple XSS in Meta Conversion API Gateway Leading to Zero-Click Account Takeover
Introduction
Account Takeover in Canvas Apps served in Comet due to failure in Cross-Window-Message Origin validation
This bug could allow a malicious actor to takeover Facebook/Meta accounts if the user decided to play a Canvas game. The new Canvas on Comet is using Compat to display dialogs( eg OAuth dialogs ) in separate iframes, the process of displaying a dialog is to first receive a message of the type of the dialog ( like oauth ) and then create an iframe hosting apps.facebook.com/compat, then that iframe…
DOM-XSS in Instant Games due to improper verification of supplied URLs
This bug could allow a malicious actor to takeover Facebook ( and Meta ) accounts after tricking the user to play an Instant Game. This bug happens since the "goURIOnWindow" Module which is widely used in Meta platforms fails to verify the scheme of the supplied URL which means we can supply a javascript URI scheme and achieve DOM-XSS. Details The function inside goURIOnWindow module has this code…