2 ms·
> Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in. I'm probably missing s
by jMyles 9y ago
> Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in.
I'm probably missing something obvious here, but: how doesn't it run in the security context of the page?
- chii 9y agopresumably ads are served inside an iframe that's different from the website it's displayed on.