But being able to inject code like that, as the article describes, could present fake login windows and whatnot for phishing attacks.