An attacker who gets a logged-in victim to load a crafted URL can silently bind their own OAuth credential to the victim's ...