Simply clicking the nefarious link from a sender grants them access to your plaintext messages and any attachments. That bit of JavaScript could even look like a legitimate link, as you'll see in the video below. From there the cross-site scripting attack (XSS) is executed and uploads your stuff to a remote server. Flaws like these have usually been common in web browsers, but as the team points out, use of rendering engines like WebKit can bring them to other apps as well.
The team reported the problem (CVE-2016-1764) to Apple before publicly announcing how it works, and the company's patch fixes things with "improved content security policy checks." As always, make sure you have all of the latest updates installed, and double check links before blindly clicking on them. Protip: The ones that start with javascript:// probably won't actually reveal what all of your Facebook friends are secretly saying about you.
iMessage executes Javascript URLs. What is this clown show. https://t.co/lxuAIutKaO
— Matthew Green (@matthew_d_green) April 8, 2016