A CTF-Style XSS Chain in the Wild: DOM Clobbering, Gadgets, and CSP Bypass 30 January 2026·1365 words·7 mins