Perhaps there are other ways to meaningfully compromise site security? It's not just a zero day that breaks out of the web browser sandbox and installs a rootki

Perhaps there are other ways to meaningfully compromise site security? It's not just a zero day that breaks out of the web browser sandbox and installs a rootkit, it's the hostile javascript running in the context of the page that might not be properly scoped and ends up stealing information straight out of the DOM (or stores or whatever.)