If JSONP is used to workaround the same origin policy, can't it be used for XSS exploits?
===

I'm trying to understand how JSONP works, and from my so far very basic understanding, I feel like it's used to circumvent the same origin policy browsers enforce. I guess this main reason behind the policy is to prevent stuff like XSS exploits (where say someone could inject a script that makes use of the local cookies on a users machine to get valuable information, say when the user has logged into their bank account....is that right?) Now if JSONP is circumventing this policy, can't it be exploited for stuff like this? Sorry if this question is very basic....I just started trying to pickup javascript a few days back, and I'm still trying to wrap my head around it :)

Thanks!