If your router is vulnerable to XSS or something like it, an attacker can probably guess its IP pretty easily (x.x.x.1).

Edit: I realized I didn't take this to its full conclusion. Guess the router's IP, exploit XSS to open ports on the router to your machine (JS knows your local IP already), carry on escalating from there.