Click on this button, and then check the address bar. Are you where it says you are?

Where do you want to go today? (Works in IE only)

This is bad because I could have tricked you into thinking you were anywhere I want, and then created a page that looks indistinguishable from the real site. I could have made a fake CNN, or Paypal, or anything. And it didn’t have to be a button either, I could have done it as soon as you came to this site. The next Google search result you click on could do this.

More on this vulnerability.