what if they add js?

What if the original page is untrustworthy and adds JS?