Had a Self-XSS chain that I struggled to exploit alone, but after some brainstorming and help from @J0R1AN, I was able to successfully exploit it using disk cache here is the writeup medium.com/@spoderx555/escal…