Bounty

Anyone willing to PM? Got an alert box, and all the google in the world says that people stop at this point because it usually requires a user attack. Would love some more information on how I get from arbitrary JS execution to RCE.