I think it is safe to say that, like the vast majority of known browser exploits, the injection mechanisms here also relied on javascript as a necessary compone

I think it is safe to say that, like the vast majority of known browser exploits, the injection mechanisms here also relied on javascript as a necessary component. Thus this is another example of the potential risks to your users when designing websites that are noscript-unfriendly. FYI, NoScript is the 4th most popular add-on for firefox. https://addons.mozilla.org/en-US/firefox/extensions/?sort=users https://addons.mozilla.org/en-US/firefox/extensions/?sort=us...