Cross-site scripting (XSS) allows an attacker to run their own JavaScript in a victim's browser, potentially stealing session cookies or compromising the machine.