UiPath Storybook XSS → Session Hijacking

Target: apollo-composite.uipath.com (UiPath Storybook)
Main app: cloud.uipath.com (Intigriti)
Story: components-link--simple
XSS type: DOM XSS via postMessage → updateStoryArgs → Link href = javascript:
Interaction: 1 click — victim clicks the fullscreen overlay
Impact: Steals UiPathSessionId cookie (Domain=uipath.com, non-HttpOnly) → session hijacking / ATO