What it all comes down to is: > If an attacker can run JavaScript on your website, they can retrieve all the data you’ve stored in local storage and send it of

What it all comes down to is: > If an attacker can run JavaScript on your website, they can retrieve all the data you’ve stored in local storage and send it off to their own domain. This means anything sensitive you’ve got in local storage (like a user’s session data) can be compromised. Buddy, if malicious JS gets to run on your domain then it's game-over for security anyway. It can read and modify all of your HTML, read and modify all of your cookies, check the state of all your password fields. Change your passwords by editing and submitting forms. I hardly see what's special about localStorage here. It's domain-scoped; that's pretty much the best any web feature can do.