I find the idea a bit unnerving, since that ability to inject script into somebody else's pages represents a serious security hole. You can do things like steal cookies, which are commonly used as identity tokens during a Web session. If the page happens to contain a form, you can steal the data that way. Many pages designed without thinking about security contains sensitive data in hidden form fields or comments, such as user IDs.

I've been working on techniques to harden Web pages against this sort of attack. I used to think it was an obscure form of attack, but now with GreaseMonkey packaging it all up with a bow so that anybody can do it, I think I'd better hurry my ass up.

The arms race never ends.