With local XSS$,$ the attack payload is embedded in the $\_\_\_\_\_$ object in the victim$$s browser used by the original client side script, such that the page itself does not change.