With local XSS$,$ the attack payload is embedded in the used by the original client side script, such that the page itself does not change.