Cryptocat prior to 2.0.22: cryptocat.js handlePresence() has cross site scripting
cryptocat project cryptocat