Silberengel on Nostr: Ditto’s bug was arbitrary JavaScript in the app WebView (XSS), not RCE, from which ...

Ditto’s bug was arbitrary JavaScript in the app WebView (XSS), not RCE, from which they could drive the app. Including the session keys, but no stealing of the key.