Taking control of the user's browser using XSS

As I mentioned before, perhaps the highest impact by an XSS is to take control of the user who is affected.

The way to do this essentially depends on the actions allowed by the web browser to execute actions using JavaScript or other client interactions, which can be passed by the malicious user in the XSS. In fact, it is not necessary to execute the JavaScript directly. For example, it's possible to exploit XSS in Internet Explorer executing ActiveX controls, like the following:

<script> 
   var o=new ActiveXObject("WScript.shell"); 
   o.Run("program.exe") 
</script> 

This code will launch another program in the remote computer, so it's possible to execute any kind of attacks on the client side.