How? If the attribute is not trusted doesn’t that mean the dom is already compromised?