Damages can come at various levels:
- simplest and lightest: simply play with the browser. As an example start a background loop that repeadetly shows popups
- slightly more advanced: remove the browser menu and intercept the close event to prevent user to simply close the application to get rid of the popups
- still one step further, play with the stored browser config by changing shortcuts or favorites to call an infected page
- hardest but more harmfull: use flaws of browsers to escape from the browser sandbox and directly access the underlying system
Depending on the system, the browser and their configurations, some of those attacks will not be possible. But even the lightest one, the background loop that continuously open popups is extremely annoying for a user, and you can be sure that he/she will never come again to your site.