Executable scripts push the browser to third-party domains without consent.