Great post!
Friendly
HTML tag
Image trick
Script tag
Post comment
UNSAFE: pasted in as HTML
SAFE: escaped first
Attacker's inbox:
empty
Each page is a sandboxed frame. Its script can only talk to this panel, never to the internet.