This vulnerability predates websockets (in fact, you can exploit it even without Javascript) - they just make things more convenient. Apparently, the shit hit

This vulnerability predates websockets (in fact, you can exploit it even without Javascript) - they just make things more convenient. Apparently, the shit hit the fan a while ago, prompting Opera to implement 'cross network protection'[1], but other browser vendors did not follow suit. [1] https://web.archive.org/web/20121001002815/http://my.opera.com/securitygroup/blog/2012/07/03/operas-cross-network-protection https://web.archive.org/web/20121001002815/http://my.opera.c...