It’s more complicated than that. For the most part the browser is a secure environment due to same origin policy. JavaScript in the browser can only send and re

It’s more complicated than that. For the most part the browser is a secure environment due to same origin policy. JavaScript in the browser can only send and receive from the domain from which that JavaScript is served, which means the JavaScript must come from your own domain or from a third party you trust. That trust is all from the perspective of the web server, though, which is orthogonal to the concerns of the end user. https://en.m.wikipedia.org/wiki/Same-origin_policy https://en.m.wikipedia.org/wiki/Same-origin_policy Browser extensions can bypass that though, which can expose you to malicious third parties.