[jxf]

This isn't accurate. There are any number of XSS attacks that can be performed, which then allow you to look at secrets or tokens in localStorage, for example.