Cross-origin disclosure of attribution cookies on bridge.xyz

This page is served from . A handler on bridge.xyz checks the sender with origin.includes("default.com") — a substring test — so this host satisfies it without having anything to do with that domain. When it passes, the handler reads the visitor's attribution cookies and posts them back to the sender.

Run the proof of concept

Press the button. A pop-up opens on bridge.xyz carrying campaign parameters, as a visitor arriving
from an ad would. This page then asks for the pixel data and prints what comes back.