I don't remember if this was a common technique, but before XmlHttpRequest (came in 2000, i think) we used to do "Ajax" by loading data into an invisible iframe and reading the contents. Worked well iirc.
Also back then (up until ~2005) browsers were hilariously insecure. For example I was in a forum of a local youth club and you could have signatures that were displayed under every post so I added some edgy image linked from my own webserver.
Some day I accidentally put the whole folder on a password protection which prompted the "username password" login window on every page my signature was linked to. FOR ALL USERS.
I realized users would think that the forum software would ask them to log in again for some reason so I basically got all passwords of people in the forum in plaintext on my webserver.
Crazy times
Or having some javascript code in the page loaded by the iframe which could call some parent. function.