Regarding XSS, [OWASP states (intro paragraph):](https://www.owasp.org/index.php/Cross-site_Scripting_(XSS))

> 
> These scripts can even rewrite the content of the HTML page
> 
> 
> 

As a user, I cannot rewrite the contents of facebook.com (other than wall posts, comments, and so on). That would require me to permanently alter their html files, which clearly no user without specific server access can do.

When I cannot do it as a user, how can possibly a maliciously injected script from facebook.com, executed by my browser, rewrite the contents of facebook.com?