JavaScript code has access to SQLite. So any webpage where the attacker controls/can inject JavaScript is vulnerable.