[Swordmaker]

I may not be able to take over your Mac (I don't know any of the arbitrary code execution holes being used right now), but it's trivially easy to get your personal information without you knowing. And it's from Safari, specifically the Apple-created (not Webkit) part of the browser.

Sorry, PugetSoundSoldier, this "exploit" doesn't work at all on my Mac... auto-fill from my address card turned on...

24" iMac, 2.4GHz Intel Core 2 Duo, Mac OSX.6.4, Safari Version 5.0 (6533.16).

I've tried on two other Macs... same results: Diddly and squat.

[PugetSoundSoldier]

So your sample of one user trumps that of a known and respected security researcher. Sorry, Swordmaker, your apologetics fall short. It’s been confirmed, and shown to happen. Read the link, read the comments - others confirm it as well.

Just because you might not have the problem (which I do not believe, you’re probably lying about your configuration), others do, and provably so. It’s a hole whether you like it or not.