The real story behind the Twitter mouseover exploit

> The hack used well-known security flaws in JavaScript

[citation needed]