Client-side vulnerabilities and their exploits expose the blind spots that most web developers have; they aren't used to owning the security on a client's platform and can fall into the trap of looking myopically at only protecting their framework or application. Hackers see this as an opportunity with a tremendous plus side. They can compromise the end user, while pivoting from them to take advantage of their authenticated or cached status and thereby compromise the web server. We as a community need to ensure application owners understand that it is in their best interests to fortify their website against exposing client-side vulnerabilities, as improved client security dramatically reduces the attack surface of the application itself.
This isn't easy--there is a near infinite combination of operating systems, browsers, patch-levels, access modes, and...
