ACCOUNT TAKEOVER IN FACEBOOK MOBILE APP DUE TO USAGE OF CRYPTOGRAPHICALLY UNSECURE RANDOM NUMBER GENERATOR AND XSS IN FACEBOOK JS SDK

Summary from the TLDR InfoSec newsletter

A security researcher chained multiple vulnerabilities in Facebook's JavaScript SDK to achieve account takeover in the Facebook mobile app, exploiting Math.random() for callback identifier generation, DOM XSS via unsanitized SVG injection in the Customer Chat plugin, and X-Frame-Options bypass in mobile webviews. The attack reconstructed the PRNG state by forcing plugin iframe reinitializations and observing leaked window.name values, enabling prediction of security-critical callback identifiers. Meta awarded a $66,000 bounty and fixed the vulnerability in December 2023.