The same-origin policy doesn't prevent XSS attacks very well. Instead, we need to use Content Security Policy. Here is an example. An Attack Prevented by CSP By Llorenç Muntaner – 04 Jan 2023 –