If today’s malware mostly runs on Windows because it’s the commonest executable platform, tomorrow’s will likely run on the Web, for the very same reason. Because, like it or not, Web is already a huge executable platform, and we should start thinking at it this way, from a security perspective.

XSS So what?
Execute arbitrary code
“Use javascript and HTML to craft custom payloads”

Content Spoofing
“Make users believe that content is legitimate when in fact it is controlled by an attacker with malicious intent.”

Phishing
“Steal user passwords by faking login portals to webbased services, devices, or web sites.”

Cross-Gadget Attacks
Gadgets can attack one another, steal cookies and/or data, manipulate the content of other gadgets.