I am wondering what risks there are if you have static pages on the same host that don't trust each other. A key concept of Javascript and web security is the Same Origin Policy (SOP), which is also the reason why we need to avoid XSS. If there's e.g. a blog on example.org with an admin interface on example.org/admin and an attacker can place some javascript on example.org/foo then the attacker can execute javascript that e.g. will create a new admin account or perform other actions on behalf of the admin. I generally understand how this is happening.
However I wonder the following: If the pages on example.org are all static, i.e. no forms that perform actions or endpoints that act on POST requests, does the SOP still matter?
I was thinking of attacks like: Can example.org/foo/ open example.org/bar/, but with manipulated content? This could be useful e.g. if example.org/foo hosts downloads that an attacker can manipulate or redirect. I have tried a few things, but I wasn't able to perform such an attack. (One way might be ServiceWorkers, but they are path constrained, which limits possibilities quite a bit.)
And are there other attacks that one should care about in purely static scenarios?