I agree... You can only validate what is presented to you; a hacker won't kindly hand you a piece of code to run after exploited a hole and ask you to verify it

I agree... You can only validate what is presented to you; a hacker won't kindly hand you a piece of code to run after exploited a hole and ask you to verify it. It also rather circuitous, browsers already verify what they are executing.