Isn this ultimately a case of users running untrusted code?
Yes. In the end, the malicious user must trick the other user into allowing his code to run, so in many ways this is similar to a Trojan horse attack. However, the methods for initiating the execution of the malicious user’s attack lend themselves to being so well camouflaged that even a cautious user might not realize that he is causing code to run.
