Discuss the security implications of embedding third-party content in an HTML document.
Instruction: Explain the risks and considerations of including third-party content, such as iframes or scripts, in your HTML code.
Context: This question tests the candidate's awareness of web security practices, specifically relating to the inclusion of third-party content and the potential vulnerabilities it introduces.
Updated
Official answer available
Read the opening below, then unlock the full answer and practical guidance.
A third-party script included in the page normally executes with the embedding page's privileges. It can access the DOM and script-readable data available to that page, regardless of where its file was hosted. A compromised allowed script is therefore a supply-chain risk, not merely a remote display dependency.
A cross-origin iframe is a separate browsing context protected by the same-origin policy, but still has risks such as tracking, deceptive UI, navigation and excessive permissions...