The interesting take away here is that Chinese web services deliberately delay/don't patch their services to accommodate Chinese spoofing. In this case the JSON

The interesting take away here is that Chinese web services deliberately delay/don't patch their services to accommodate Chinese spoofing. In this case the JSONP vulnerability from 2013 allows them to hack a users computer, thereby compromising any data on that computer. Neither tor nor Vpn is compromised.