Sure, but that's ultimately a pretty unlikely attack vector. An attacker still needs to exploit some unknown vulnerability of your web browser in order to get something malicious going.

I basically expect that sort of attack to only be pulled off by a state actor or by a black hat convention for the lolz.