DOM-XSS in Instant Games due to improper verification of supplied URLs
This bug could allow a malicious actor to takeover Facebook (and Meta) accounts after tricking the user to play an Instant Game. This bug happens since the
goURIOnWindow
Module which is widely used in Meta platforms fails to verify the scheme of the supplied URL which means we can supply a javascript URI scheme and achieve DOM-XSS. DOM-XSS in Instant Games due to improper verification of supplied URLs