Doesn’t any <script> tag let you run arbitrary code inside a sandbox anyway?