Contrived example: say Google has a URL like
mail.google.com/json?action=inbox which returns the first 50 messages of your inbox in JSON format. Evil websites on other domains can't make AJAX requests to get this data due to the same-origin policy, but they can include the URL via a
<script> tag. The URL is visited with your cookies, and by overriding the global array constructor or accessor methods they can have a method called whenever an object (array or hash) attribute is set, allowing them to read the JSON content.
&&&BLAH&&& prevents this: an AJAX request at
mail.google.com will have full access to the text content, and can strip it away. But a
This does not address the issue of cross-site request forgery.