Gaining sensible information from advertisement displayed in web pages

Question

As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy].

Unfortunately, same origin policy does not apply to newly created DOM nodes, that for example link JPEGs of third party domains. Thus, using this media link, a malicious script could pass sensible information to any third party using GET parameters.

Suppose site A loads a JavaScript file from an advertising company to display advertisement. Normally, ads get selected e.g. by user's previous search operations. Since the ad delivery process happens at the advertiser's server, privacy related information wouldn't get exposed to site A (in a direct fashion).

But technically, the JavaScript does some DOM manipulation to make the advertisement visible in pages of A. Therefore A could prepare a JavaScript file, which traces the operations of the script of the advertiser. Specifically, A could trace which exact advertisement gets displayed.

Suppose this arguments are correct, would A be able to regenerate sensible privacy information of users?

Specific example

• User U uses Google to search for certain health problems.
• Thus, Google analytics targets user U as ill regarding some disease.
• A is an insurance company, which sells health insurance plans.

If U surfs on A's site, A could reject health insurance due to the fact, A scans advertisement presented by Google for U.

• Does this is pure theory?
• Or may this happen?
• Does is actually happen?

Answer 1

As a rule, this doesn't happen in real life. Typically third-party content of this variety loads in a separate iframe, the content of which is (ostensibly) not accessible to the DOM of the outer page. There's been some issues with that in the past, but it seems that people have moved on, so presumably the issues are fixed.

More interesting than ads, though, is this same principle applied to thinks like the Facebook social plugins. The plugins will insert text like "Your friend Rory Alsop liked this page" along with pictures of your friends. This means that if the site operator has access to that content, then he can determine who your facebook friends are, and perhaps your own facebook identity.

This is much more significant than guessing your maladies from Google ads.