Ownz0red by an img tag :(
Here is an interesting MeFi thread about Cross Site Request Forgery. It was taking a while for my brain to grok the attack until I came to this comment, in which poster embedded an image that pointed to a GET Web API instead of actually linking to a jpeg (CSRF link since removed). Everyone who read that comment while logged in had that comment marked as a favorite, since their browser happily called the GET url and passed their login information via cookie.
My first thought was that this would be an easy attack to avoid, but it’s crazy scary, unless maybe your web app doesn’t use cookies. Just switching to POST isn’t good enough.