late to the forum thread and i have no clue what to discuss but in my opinion the new web is less customizable and i am tired of ads and websites it felt all the same

Here's a funny one. You've ever seen a web browser exploit inside of Source?

Eversince the Panorama UI update to CS:GO in 2018, around the same time Valve began Electron-ifying the Steam client, CS has used a chromium-based HTML5 engine to display it's user interface and HUD. For a web browser sitting inside a video game, it's surprisingly performant and not terrible, especially sitting next to Valve's other attempts. But in Counter-strike 2, Valve forgot to sanitize Steam usernames in the voting window.

What this means is that players can join your CS game and literally XSS you by just joining your server and then calling a command to votekick themselves. You would think a massive game company would know better, but I guess not. This was just discovered lastnight it seems.

People seem to be using <img> tags as fitting Javascript code into a Steam username is... well, impossible. So the preferred method to exploit this is to have an embed linking to a PHP file on somebody's server. This is currently being used to steal the IP addresses of players.
archive


Forum thread where people were testing it out: https://archive.is/3IPpk