[homakov]

no cookie/XSS or any real vuln here involved. This is completely standard design problem of sandbox domain. Check out http://homakov.github.io/guc.html

[ororlrlrlylyly]

Oh, btw, also, you may be interested in window.setTimeout.

[homakov]

i am js jedi, but don't spend much time on PoCs.