A critical XSS vulnerability on Facebook's CDN was achieved by encoding malicious JavaScript into PNG IDAT chunks, uploading the image as an advertisement, then serving it with an .html extension to trigger HTML interpretation via MIME sniffing. The attacker leveraged document.domain to access the fb_dtsg CSRF token from www.facebook.com and bypass LinkShim protections.
A detailed technical writeup of discovering and exploiting polymorphic image-based XSS vulnerabilities on Google Scholar by embedding JavaScript payloads in JPEG/PNG metadata and entropy-coded segments that survive image processing transformations. The author developed techniques to bypass Google's image reprocessing backend and created a test suite for image library behavior analysis.