Using Inter-protocol Communication the zombie browser will send commands to a listening bindshell. The target address can be on the zombie's subnet which is potentially not directly accessible from the Internet.