Browser Patch to Prevent Cross-Site Scripting Was Deployed to Entrench Big Tech

If one bit of js can query google and bing, what hinders an evil developer to query my current session of my banks website? Or my <your favourite online store> account?