Simple but harmless attack

<script>alert('Oh No!');</script>
If this script is sent by a trusted site, it will be trusted as much as the site that sent it. This is where the danger lies.