I'm not sure which attack vector you are referring to, but there has been a lot of work going into security recently. Each application gets a sandbox that it can't break out of. This is done by creating facades for the various APIs, which prevents applications from overwriting system objects and functions (if an application were to overwrite System.openFile(), that would only take effect for that application.
The Window Manager is a point of weakness at this time, because it does not adequately conceal it's inner DOM elements. That means applications are still able to access the visual layout of other applications, which presents a security concern for applications that display sensitive information. However, the problem is noted and will be tackled at the next available time.
Keep in mind, just the same as your offline desktop, apps need to be installed, or provided by us. When you install an application, you should be sure it is from a provider you trust. Additionally, since applications are 100% JavaScript and packaged in a similar format to Mozilla Addons (a renamed .zip file), it is possible to inspect any application's source code.
__________________________________________- Jason
|| developer amoebaOS
@ developIT