You don't even need to inject code into a public website. There have been no shortage of zero-click exploits for iMessage