3 ms·

True. Although…you could also potentially use reflected URLs or cookies to pull off some kind of XSS attack.