[emlun]

No - that process _remains_ a pathway for exploits against the particular website being targeted. The process does not open new pathways for transferring exploits from one site to another - on the contrary, such exploits are made more difficult by the separation of credentials.

[not_that_noob]

See my reply to your other comment and review CTAP in the spec.