That means loading a webpage from the internet, which then runs the exploit in javascript on your local machine. Tricking users to load the page through phishing or through ads served from shady ad networks is ‘all’ it takes