> What you seem to have discovered are client-side vulnerabilities that would require direct network access to the client machines to be exploited

It’s so weird how many people (developers!) actually seem to believe this.

Websites can send bad stuff to local ports!