> element.innerHTML = fetchData(endpoint); Presumably element here is <head> or later, so scripts wouldn't execute. Also, you'd presumably define things such

> element.innerHTML = fetchData(endpoint); Presumably element here is <head> or later, so scripts wouldn't execute. Also, you'd presumably define things such that new <script> tags would be ignored if they were parsed temporally after the first non-<stript>, non-<html> tag, regardless of their position in the DOM, so that you'd need to explicitly eval any dynamically loaded scripts. Thanks for the pointers to CSP. I'll have a look. In any case, the default should have been to ovoid in-band signalling, and perhaps have a CSP-like mechanism to relax security constraints. Sure, hindsight is 20/20, but precedents in phreaking are obvious.