XSS bugs in sandbox domains