However, an attacker would have no way to force the user to visit the website. source: www.techworm.net