That's not relavent to the attack discussed in the article. These types of attacks do not involve javascript, nor could they due to the same origin policy.