This is a much more likely attack scenario than browser zero days.