In Cross$-$Site Scripting $($XSS$),$ where does the malicious script execute?

Group of answer choices

On the web server

In the user$$s browser

On the attacker$$s system

Can be either the user$$s browser or the attacker$$s system