(Assuming I'm understanding the exploit correctly, obviuosly:) Limiting JS to a few sites won't protect you fully from this attack, though it will obviously li

(Assuming I'm understanding the exploit correctly, obviuosly:) Limiting JS to a few sites won't protect you fully from this attack, though it will obviously limit your exposure. If one of your trusted sites, A, has been compromised by, say, an XSS attack, with the ability to inject JS then this attack can be leveraged to also compromise your access credentials to site B by redirecting your login attempt on site B to a malicious imitation of site B's login page. (Of course this assumes that you already have B open in a tab somewhere and that you opened site A through a _blank link on site B. Mostly I would think that would be a plausible scenario for sites mostly based on user-generated content such as forums, social media, and such.) AFAICT always explicitly force-reloading any login page should make you a lot safer, but remembering to always do that is perhaps not realistic.