The GFW works both ways. That attack injected code into Chinese browsers viewing sites outside the GFW, but it could just as easily inject code into browsers outside the GFW viewing Chinese sites...