CodePark/ questions / Supply chain & third-party scripts
START PRACTICINGPRACTICE
Frontend question · Frontend security › Supply chain & third-party scripts

You add a chat widget with <script src="https://widget.vendor.com/chat.js"></script>. What can that script do on your page?

Everything your own JavaScript can do: read the DOM and form fields, read localStorage and call your API as the user

A script runs with the origin of the page, not the origin of its URL. So the widget has the same power as your own code. If the vendor is hacked, the attacker gets that power. This happened in 2024, when the polyfill.io domain changed owners and served malicious code to many sites.

"The browser isolates scripts from other origins" is the tempting wrong answer. Only an <iframe> from another origin gives that isolation. Safer options: load widgets in a sandboxed iframe, limit them with CSP, and keep third-party scripts off login and payment pages.