XSS attacks have several things in common with clickjacking, but they differ by the endpoint of the attack. XSS usually ends up downloading and installing malware on the victim’s device via throwing it on downloading pages or exploit landings. All this nasty stuff is done via exploiting the JavaScript functions and the vulnerabilities of a certain site. Clickjacking also uses JavaScript, but only to draw an invisible frame over a legit page.