This could trick a surfer into revealing data such as a password. "The problem is that JavaScript dialog boxes do not display or include their origin, which allows a new window to open--for ...