Comment by pie_flavor

OBS explicitly disabled the security feature that would have prevented this attack in a real browser.