This seems obscure, but potentially useful. It seems that the window title javascript attribute persists, even when the window it is describing changes from one URL to another. This in turn allows a script form one site to populate it, and a script from another site to read it. A sneaky way round some of the limitations of cross-site scripting (XSS).
↧