Cross-site scripting

Getting attacker-controlled script to execute in another user's page, with full access to their session, their DOM and anything the origin can reach. It is the defining browser vulnerability because the same-origin policy grants that script everything your own code has. Every variant comes from the same root cause: data crossing into a context where it is interpreted as code.