Of course! But it depends. Zero-click is essentially client‑side XSS.