Is there a vulnerability other than XSS which can result in client side script execution?

Question

If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-resource supply chain attack?

• XSS is Cross Site Scripting - Be it reflected, persistent or DOM based.
• A sub-resource supply chain attack is where you compromise a sub resource such as CSS, javascript, flash objects etc by compromising the supply chain ie; compromising the CDNs, S3 buckets etc or by MITM a subresource loaded over non-https channel.

Answer 1

Note that this answer applies to the initial version of the question which was less strict and clear about what the OP would actually like to know.

---

To execute malicious script on the client side in the context of the web application the script

• might be injected cross site by the attacker for example inside the URL (reflected XSS)
• might be served by the original webserver because the server was compromised or had a stored XSS vulnerability
• might be done by loading or moving the client side of the application into some unexpected context (DOM XSS)
• might be injected on the client side using a browser extension, which can be controlled by the attacker either because the extension is malicious or has bugs
• might be injected by misusing script includes for third-party, for example when including ads or tracking (malvertising)
• might be provided by the attacker using a MITM attack (thanks to Anders for this idea)

And of course there might be bugs in the browser which makes this possible (universal XSS).