> So custom components cannot be included from third party sources? If they can then this is exactly the same problem. They can, but you can separately decide

> So custom components cannot be included from third party sources? If they can then this is exactly the same problem. They can, but you can separately decide whether to support components from arbitrary off-site sources (most sites wouldn't) vs accepting styling for arbitrary off-site sources. > That `behavior` thing can use 'same origin' rule as we have now for any other JS code. There is no same-origin restriction for JS included directly with the <script> tag. Most websites are not designed to expect the <stye> tag to be a backdoor <script> tag. If you mean to invent some novel security restrictions on JS running in the same frame, trust me, it will end up more complex than Custom Elements.