Stealing one of patio11’s ideas, there is a whole bucket of internet points waiting for the person who can carefully document Google’s history of allowing arbit

Stealing one of patio11’s ideas, there is a whole bucket of internet points waiting for the person who can carefully document Google’s history of allowing arbitrary JavaScript injection. Two people mention examples below, but they reference DoubleClick (acquired by Google in 2008), and a 2015 incident. Is this still possible? What measured does Google take to limit what advertisers can do? P.S. in addition to internet points, you’d also be providing important information for anyone who cares about privacy and security. But I’m a little cynical, so did you hear about the Internet points?