Vulnerability Instance

Paul Nickerson demonstrated that if an attacker could convince a user
to right-click on a broken image and choose "View Image" from the context
menu then he could get javascript to run on a site of the attacker's choosing
by making the image src attribute a javascript: URL and loading the target
site on mousedown. This could be used to steal login cookies or other
confidential information from the target site.Similarly, if a user could be convinced to right-click and choose
"Show only this frame" on a frame whose src attribute is a javascript: URL
then that script would run in the context of the framing site. In order
for this variant to be effective not only would you have to convince the
user to view the frame, you would have to find an interesting target
site that can be made to host a frame of the attacker's choosing.