This pdf looks at what new capabilities an XSS attacker gains from recent developments in JavaScript.