However, any attempts to do this will run afoul of the same origin policy in the browser. This states that if a script requests a document from a site with a different host, port, or protocol, the response will be denied from the script unless it is explicitly approved by the destination site.
The closest analog to what you are talking about is XSSI/JSON hijacking. These are different techniques to bypass same-origin-policy restrictions in the browser:
However, the techniques that allow these restrictions to be circumvented have largely been patched in modern browsers, making the vulnerability much less relevant:
It is always possible that additional such weaknesses can be found in the future, in which case there are some techniques to protect against XSSI (h/t Xavier59):