An attacker can execute scripts by calling console.log, and may even run local executable files, thus attacking the user's computer!