As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy].
Unfortunately, same origin policy does not apply to newly created DOM nodes, that for example link JPEGs of third party domains. Thus, using this media link, a malicious script could pass sensible information to any third party using GET parameters.
Suppose site A
loads a JavaScript file from an advertising company to display advertisement. Normally, ads get selected e.g. by user's previous search operations. Since the ad delivery process happens at the advertiser's server, privacy related information wouldn't get exposed to site A
(in a direct fashion).
But technically, the JavaScript does some DOM manipulation to make the advertisement visible in pages of A
. Therefore A
could prepare a JavaScript file, which traces the operations of the script of the advertiser. Specifically, A
could trace which exact advertisement gets displayed.
Suppose this arguments are correct, would A
be able to regenerate sensible privacy information of users?
Specific example
- User
U
uses Google to search for certain health problems. - Thus, Google analytics targets user
U
as ill regarding some disease. A
is an insurance company, which sells health insurance plans.
If U
surfs on A
's site, A
could reject health insurance due to the fact, A
scans advertisement presented by Google for U
.
- Does this is pure theory?
- Or may this happen?
- Does is actually happen?