They trick a user into going to a Web site and inputting the "evil script", perhaps by sending the user an innocent URL in an email.

他们欺骗用户进入一个Web站点并输入“恶意脚本”，欺骗手段可以是通过email向用户发送无害的URL。

youdao

"Use it as you want, at your own risk, but... please... use responsibly, do not use this trick to do evil !!!"

CNN: Security flaw allows snoopers to access locked iPhones