I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's possible that a conversation partner of the user could have malicious intentions, and try XSSing the conversation. To counter this, I want to be 100% sure that it's impossible for the application to send any messages after the initial page load, since it's acceptable if any XSS breaks the JavaScript application, but it's not acceptable for any messages to be sent.
Is there a way to be certain that my JavaScript application will not send messages anywhere after page load, when there is possibility of XSS attacks?