What if the original page is untrustworthy and adds JS?