Oct 20, 2026, 7:38 PMRE: https://mastodon.social/@arstechnica/117473258140283378
I saw this but didn't report it because I was sure that meta would classify this as intended behavior lol. They have deployed tooling for direct VM-to-VM messaging and other sharing modalities as well, so this is only going to get more fun
Oct 21, 2026, 1:53 AMThis same vuln affects other shared things in muse so I guess if this is bountyable then I'll report that lol.
Oct 21, 2026, 2:54 AMThe reason its like this is because shared conversations and spaces and artifacts need to be on different subdomains is because they are arbitrary fullstack web content, so if they just used a path segment then they would allow cookies, local storage, etc. from one context to bleed into another, and every space turns into a credential harvesting vector. Other things like githubusercontent dot com work because they only host static user content.
Oct 21, 2026, 2:55 AMOh lmao they have disabled all sharing including static pages, great job everyone.