Reading the source the compromise is on these lines in particular (https://github.com/Yaffle/EventSource/blob/de137927e13d8afac153d2485152ccec48948a7a/src/event

Reading the source the compromise is on these lines in particular (https://github.com/Yaffle/EventSource/blob/de137927e13d8afac153d2485152ccec48948a7a/src/eventsource.js#L1032-L1090 https://github.com/Yaffle/EventSource/blob/de137927e13d8afac...). To experience the exploit set your computer timezone to any Russian timezone (e.g. asia/omsk) and paste the following data URL to your url bar: data:text/html;charset=utf-8,<!DOCTYPE html><title>EventSource</title><meta charset="utf-8"><script type="module">import "https://unpkg.com/event-source-polyfill@1.0.26"</script> In 15 seconds an alert window will open with a message which translates to: > On February 24, Russia attacked Ukraine. > The people of Ukraine are universally mobilized and ready to defend their country from enemy invasion. 91% of Ukrainians fully support their President Volodymyr Zelensky and his response to the Russian attack. > The whole world condemned the unjustified invasion and decided to impose unprecedented sanctions against Russia. With each new day, they will be felt more and more strongly among civilians. > At the same time, the Russian government restricts citizens' access to external information, planting one-sided formulations and versions of what is happening. > As a reliable source of information, download the secure Tor Browser: > https://www.torproject.org/ https://www.torproject.org/ > And visit: > https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion/russian https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6a... > Stop this senseless war! Stop war criminal Putin! After you dismiss the alert window a new window will open with the page http://www.change.org/NetVoyne http://www.change.org/NetVoyne