> " the fact that it has to be triggered with a specific sequence of HTTP requests," Does not sound like a limitation at all. This is the very normal "browser

> " the fact that it has to be triggered with a specific sequence of HTTP requests," Does not sound like a limitation at all. This is the very normal "browser attack model" where you assume that an attacker can execute code in your browser. (aka he either controls a webpage you are visiting, a banner on a webpage you are visiting or the network stream and messes with http webpages you are visiting).