Script from one site can access keystrokes send do another site.
vulners.com/securityvulns/securityvulns:doc:5840