Frontify Storybook XSS → Cookie Toss → Session Fixation → ATO

Target: components.fondue-components.frontify.com
Vector: postMessage → updateStoryArgs → polymorphic as prop → Heading renders as iframe[srcDoc]
Impact: 0-click XSS → cookie toss on .frontify.com → session fixation on app.frontify.com → ATO
Interaction: None (0-click)

ATO Chain:
1. Attacker logs into Frontify → captures frontify-session-id
2. Victim opens this page → Storybook loads in iframe
3. postMessage injects iframe[srcDoc] via polymorphic as prop (0-click XSS)
4. srcDoc JS sets frontify-session-id=ATTACKER_VALUE on Domain=.frontify.com; Path=/
5. Victim is redirected to app.frontify.com → browser sends TOSSED cookie (domain) + REAL cookie (host-only)
6. Server reads first cookie (tossed) → victim operates in attacker's session
7. Victim authenticates → attacker's session gains victim's credentials = ATO

Frontify: Storybook XSS → ATO via Cookie Toss