After it gains your trust, it then has access to your machine to do whatever else it likes in the background. As an example, last December, two German students wrote a software product that allowed users to customise their Internet software. It appeared to work as advertised, but also secretly e-mailed the user's password to the students. This action went undetected until March, when the students themselves revealed it to the press - to demonstrate the security risks faced by Internet users. While it's displaying a file in your Web browser, it can do anything else it likes to your computer.
Malicious users can exploit bugs to make the software behave in unintended ways.
The bugs allow malicious users to worm their way into your computer and perform their own actions. Although it performed no permanent damage, it spread so quickly that it infected over 6000 computers and brought the Internet to a grinding halt in days. An ActiveX control is like a plug-in, but worse. Suppose you're browsing the Web and an error message pops up, saying you have been disconnected and asking for your user name and password again. Many people would, and dutifully follow the instructions.