Hotjar postMessage XSS PoC

Launcher origin: https://voc.hotjar.com.merviqtechnologies.com

The target opens automatically. In the Hotjar widget on the target:

1. Click Start the task.
2. Click Mark as done.

The PoC then sends the payload automatically and displays alert(document.domain) in the target origin.

Preparing test…