How could this possibly work without port forwarding?

2 months ago: https://news.ycombinator.com/item?id=44169115.

Of course Facebook's JS won't add itself to websites, so half of the blame goes to webmasters willingly sending malware to browsers.

It happens on the same device. No forwarding necessary. And it was documented to happen, the story was on HN