It's possible to execute remote Javascript through CSS in Internet Explorer and possibly Firefox according to this: http://stackoverflow.com/questions/476276/us

It's possible to execute remote Javascript through CSS in Internet Explorer and possibly Firefox according to this: http://stackoverflow.com/questions/476276/using-javascript-in-css http://stackoverflow.com/questions/476276/using-javascript-i... You can also clickjack, i.e. make a button that does something important invisible and stretch it across the entire page. Next time the user clicks, they'll inadvertently be clicking the button. Edit: I did some research and testing and it looks like XBL and element behaviors are no longer possible in Firefox and IE 10, thankfully: http://stackoverflow.com/questions/9679527/do-moz-behaviors-work-in-firefox-10/9679627#9679627 http://stackoverflow.com/questions/9679527/do-moz-behaviors-... http://msdn.microsoft.com/en-us/library/ie/hh801219%28v=vs.85%29.aspx http://msdn.microsoft.com/en-us/library/ie/hh801219%28v=vs.8...