Mail.ru: XSS in touch.sports.mail.ru

The XSS vulnerability is located here: https://touch.sports.mail.ru and is triggered by setting referer to: tttttalert0 The problem is that the referer is being loaded like so: html Other Javascript Here "httpReferer":"ttttt alert0 ","user":"","topBanner":"sz":9,"slot":3333,"retinaBanner":"...