Cross-domain script include
Summary: PortSwigger Research describes the cross-domain script include issue: when an application loads a script from an external domain, the browser runs it in the invoking application's security context, so it can access application data and act as the current user. The write-up states that including such a script means trusting that domain's security to stop an attacker from modifying the script to act maliciously inside the application.
Bottom line: Every third-party script you include runs with your application's own privileges, so a compromise or tampering at that external domain becomes a compromise inside your application under your users' sessions. PortSwigger's suggested mitigations are Subresource Integrity verification, hosting the script yourself, or reimplementing its functionality.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026