you never heard of HTTP request smuggling or XSS then... Let alone being able to fingerprint and dump all your browser history and session data, cookies, etc.