An attacker can inject the code with a temporal trigger, remaining dormant until a predetermined exact time. Doesn't require knowing when they'll open the link: Simply waits X seconds from when the ...