Preliminary research

The Last Writer Wins: A Chess.com Account Takeover via postMessage XSS

XENOPS Research · XENOPS · 4 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

A Chess.com postMessage handler accepted foreign-origin state. Its HTML wrapper removed diagram comments before DOMPurify, then restored them into attacker-placed placeholder tokens inside attributes, creating XSS. The account-takeover example depends on an authenticated SSO-created account that can set its first password without an old one.

Record

Researcher

XENOPS Research

Published by

XENOPS

Date

4 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier sanitizer integration case (2023)
• Earlier placeholder-collision fix (2020)
• Earlier remove-sanitize-restore example (June 2026)

Tags

• xss
• postmessage
• sanitizer-bypass
• dompurify
• case-study
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of XENOPS Research, first published at the original source. Preserved copies are kept so the citation survives its host.