Streamlabs Charity DOM XSS – Browser-Only PoC

This page uses only standard browser APIs. It opens the genuine streamlabscharity.com sign-in page and repeatedly sends a benign postMessage payload while you click a social-login provider.

Important: host this file on an HTTPS origin whose hostname itself contains streamlabscharity. Do not enter credentials or complete the external OAuth login.
  1. Open this hosted PoC URL in a normal browser.
  2. Click Start verification below.
  3. In the genuine Streamlabs Charity popup, click Twitch, YouTube, or Facebook once.
  4. A successful reproduction displays alert(document.domain) in the target page.
Ready.

Benign proof only: no credentials are collected, no authenticated data is read, and no account, charity, cause, or donation is modified.