Xss is cross site scripting? I thought local storage read write was per domain. Why would cookies be better?

Oh right, the malicious code could come from your origin for one.