bug-bounty622
facebook468
xss316
google162
microsoft106
rce105
apple69
csrf61
web354
account-takeover54
writeup51
exploit43
sqli41
cve37
ssrf35
dos33
cloudflare33
malware30
privilege-escalation29
defi28
smart-contract-vulnerability25
node24
idor24
subdomain-takeover24
smart-contract23
clickjacking23
ethereum23
access-control21
vulnerability-disclosure21
browser20
auth-bypass20
lfi19
aws19
remote-code-execution18
docker17
reverse-engineering17
react17
cloud17
oauth16
cors16
race-condition16
info-disclosure15
solidity14
authentication-bypass14
phishing13
supply-chain13
wordpress12
denial-of-service11
delegatecall11
sql-injection11
0
5/10
A data sanitization vulnerability in Instagram Web's Notes feature allowed users to extract original video files with audio by copying the video URL from browser DevTools, bypassing the intended silent playback design. The vulnerability was specific to certain server nodes and was fixed after responsible disclosure to Meta, earning a $1,000 bounty.
privacy-bypass
audio-leakage
url-extraction
web-vulnerability
instagram
data-sanitization
bug-bounty
responsible-disclosure
frontend-bypass
meta
Instagram
Meta
Javier González Casares
Case ID: 3950957211809485