Facebook pays out $25k bug bounty for chained DOM-based XSS

A logged-in user would fall prey to an attack exploiting the critical flaw in Facebook’s payments redirect page by visiting, then clicking on, an attacker-controlled website.