Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????

We seriously need more information.