Slack contains an XSLeak vulnerability that de-anonymizes users

Known as a cross-site leak, the flaw allows attackers to circumvent same-origin policy, a browser security feature that prevents tabs and frames of different domains from accessing each other’s data.