Youssef Sammouda (sam0) personal blog

Facebook Javascript SDK and Facebook plugins Meta provides several embeddable plugins such as the Like button, Customer Chat plugin, and Feedback plugin.

Introduction FXAuth is Meta’s shared authentication system used across Facebook, Instagram, and Meta (Horizon / VR).

Introduction This write-up consolidates several XS-Leak issues discovered across Meta-owned platforms, including Facebook, Workplace, Meta for Work, and internal Meta surfaces.

Introduction Meta’s web ecosystem relies on cross-window messaging between first-party websites.

Introduction Facebook relies on long-lived device identifiers to reduce friction for returning users and to distinguish legitimate activity from suspicious logins.

Introduction Facebook’s payments and billing flows rely heavily on third-party financial service providers.

Introduction Facebook and Instagram accounts are deeply integrated through Accounts Center, allowing users to link identities, share authentication methods, and manage security settings across platforms.

Introduction The Meta Conversions API Gateway is a server-side solution developed by Meta (formerly Facebook) that allows businesses to send web events, such as customer interactions and purchase data, directly from their servers to Meta’s platforms, bypa…

This bug could allow a malicious actor to takeover Facebook/Meta accounts if the user decided to play a Canvas game.

This bug could allow a malicious actor to takeover Facebook ( and Meta ) accounts after tricking the user to play an Instant Game.