TikTok Ads Tea arbitrary-origin DOM disclosure PoC

This page opens an authenticated affected Ads route, starts its Tea heatmap core, accepts the TinyRPC connection, and forwards the exposed DOM text records to the embedded researcher webhook.

Authorized test only. One request will contain raw visible DOM textContent and XPath/position metadata. It does not contain cookies or arbitrary API responses.

Controlled advertiser/account ID Affected Ads route Embedded researcher-controlled webhook I authorize forwarding raw visible DOM text from this controlled test account

Not started.