Wouldn’t the exploit code be able to bypass all those cross domain checks? As long as they are running in the same sandbox, right?