Content-Embed-UI postMessage XSS — research.hubspot.com

Demonstrates arbitrary JavaScript execution on production research.hubspot.com via the CEUI SetContent postMessage sink. One click opens the slot popup; the payload reads Domain=.hubspot.com cookies from the production origin.