This defeats your security in IE: (A bit of a moot point since IE doesn't support the crypto API anyway, but still.) document.body.innerHTML += '<script>do

This defeats your security in IE: (A bit of a moot point since IE doesn't support the crypto API anyway, but still.) document.body.innerHTML += '<script>document.write("<plaintext>"); document.body.childNodes[document.body.childNodes.length-1].contentWindow = {crypto: {getRandomValues: function() { alert("Ha!"); }}};</script>';