If one bit of js can query google and bing, what hinders an evil developer to query my current session of my banks website? Or my <your favourite online store>

If one bit of js can query google and bing, what hinders an evil developer to query my current session of my banks website? Or my <your favourite online store> account?