With local XSS$,$ the attack payload is embedded in the $q,$ object in the victim's browser used by the original client side script, such that the page itself does not change.

$$