But "any website" here seems to be "any non-https website", so this is more likely: a) router or baseband-processor hack plus b) malicious JS injection into une

But "any website" here seems to be "any non-https website", so this is more likely: a) router or baseband-processor hack plus b) malicious JS injection into unencrypted HTML plus c) browser vulnerability via JS. No need to bypass encryption.