While i agree, the current JS security model rally doesn't allow for distinguishing origin for JS code. Should that ever change, advertisers will just require that you compile their library into the first party js code, negating any benefit from such a security model.

If it happened browsers started to warn their users about third party JS doing back button history stuff, I have a hunch, that many frontendies would just shrug and tell their visitors: "Oh but for our site it is OK! Just make an exception when your browser asks!" just like we get all kinds of other web BS shoved down our throats. And when the next hyped frontend framework does such some third party integration for "better history functionality" it will become common, leading to skeptics being ridiculed for not trusting sites to handle history.

Nothing loaded from the web should be able to fiddle with any browser behavior, yet here we are.

> I feel like anything loaded from a third party domain

Unfortunately this would break some libraries for SPA management that people sometimes load from CDNs (external, or under their control but not obviously & unambiguously 1st-party by hostname) instead of the main app/page location. You could argue that this is bad design IMO, and I'd agree, but it is common design so enforcing such a limit will cause enough uproar to not be worth any browser's hassle.

I do like that they follow up this warning with “We encourage site owners to thoroughly review …” - too many site/app owners moan that they don't have control over what their dependencies do as if loading someone else's code absolves them from responsibility for what it does. Making it clear from the outset that this is the site's problem, not the user's, or something that the UA is doing wrong, or the indexer is judging unfairly, is worth the extra wordage.

The history stack shouldn't be controlled by any loaded sites. The browser needs to treat websites as hostile.

GOOGLE is an advertising platform.

anything loaded from a third party domain shouldn't be allowed to run scripts.

There are valid use cases however the issue is rooted in lacking browser APIs.

For instance,

- if you want to do statistics tracking (how many hits your site gets and user journeys)

- You have a widget/iframe system that needs to teardown when the SPA page is navigated away

- etc

The browser does not have a;

   globalThis.history.addEventListener('navigate')