Algolia Satellite Storybook — 0-click DOM XSS verification

Target origin: https://satellite-storybook.algolia.com
Vector: arbitrary-origin postMessage → storybook-channel / updateStoryArgs → React element revival (_gsymbol_react.element) → <iframe srcDoc> with no sandbox
Proof: the injected payload runs in the target origin, writes a unique DOM marker, and reports origin-scoped state back to this page. No alert() is used.