DOOM — Chaining CSPT, Open Redirect, and XSS

How a Client-Side Path Traversal, an Open Redirect, and an innerHTML sink chain into one-click XSS and account takeover on the DOOM box.