Yeah. Of course it shouldn’t be possible, but I guess no one had thought of it before or they thought the risk was too low because they figured you’d have to make an app to do it not some random HTML on a webpage.