Mail.ru: Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage()

mailru.core.js as used by GMR/store.my.games application was vulnerable to XSS via PostMessage handler...