The XSS could've been escalated to an account backdoor via extracting the "Connect to Google" URL, authenticating into it with an account you owned, then using an XSS hook to send an HTTP request with the callback to bind the attacker's Gmail account to the victim's Chess.com account. You couldn't tamper with any part of the HTTP request without it giving an unauthorized error as the application was using some sort of secret to sign the whole request. Even though we didn't have a way to sign the HTTP requests, we could just simply search for a specific user via the mobile app, intercept the traffic, and lastly be able to see the HTTP response containing the victim email address.