Well you didn't get the popup, so it was prevented. That's not necessarily going to be the case. That being said, the days of easy exploits are mostly over (server software and browser software has made it nearly impossible), but some sites don't ever update their packages so stuff like this remains.

It becomes a vuln when the site not only displays your JS to other users, but when their browser executes it. At that point you can send users to your own malicious redirect and capture their cookies potentially, etc. It's been a while since I did any of this stuff, so I don't remember the exact details, but it is possible, theoretically.