How We Are Able To Hack Any Company By Sending Message - $20,000 Bounty [CVE-2021–34506]

Published on 07 June 2025

Hello Folks, I hope everyone is doing well in this pandemic & making full use of it for learning new stuff. This is a story about hacking into major companies like Facebook, Google, Microsoft, etc.

On June 3rd, me (Th3Pr0xyB0y / Vansh Devgan) and my friend MrRajputHacker (Shivam Kumar Singh) were hunting on a mail.ru subdomain (from Hackerone).

Since the program was in Russian and we were using Firefox with Burpsuite, we had trouble translating the page. We looked for translation extensions but found many were removed due to vulnerabilities. This led us to explore how vulnerable browser extensions can compromise security.

We then decided to target Microsoft Edge due to its built-in translator and bounty program. We discovered that translating a page with an <img src=x onerror=alert(1)> payload resulted in an XSS execution due to lack of input sanitization.

Below is the affected code snippet:

We created a POC.html file containing multi-language text and an XSS payload:

Steps To Reproduce

Create and save a file named POC.html with the provided code snippet.
Run a local Python server in the same directory:
```
python3 -m http.server 80
```
Open Microsoft Edge (Version 91.0.864.48) and visit http://localhost/POC.html
Click "Translate" when prompted.
XSS payload executes and shows alert(1).

Note: A server is needed because Edge may not prompt for translation when opening a local file directly.