By exploiting a browser's interpretation of tags, a security researcher was able to execute JavaScript to modify dropdown box options, which were previously restricted by the W3C spec and HTML blockages.