Comment by mdavidn

Malicious client-side code can still perform any user action, exfiltrate user data via cross-domain requests, and probe the user's local network.