The browser enforces it, not the website. You can't use in-browser JavaScript to load a page from a site other than the one you downloaded the JavaScript from.

The browser enforces it, not the website. You can't use in-browser JavaScript to load a page from a site other than the one you downloaded the JavaScript from. Otherwise any site you visited could load gmail in the background and read all your email. It's inconvenient when you're making client-side applications, but for the web to have any kind of security it's absolutely essential.