JavaScript injection is the insertion of attacker-controlled script into a web page so that it executes in visitors' browsers with the same privileges as the page's own code. Once running, injected script can read the DOM, capture what users type, and send data anywhere — the mechanism behind formjacking, Magecart, and most client-side data theft.
How does JavaScript get injected?
| Injection path | How it works | Who is compromised |
|---|---|---|
| XSS (reflected / stored / DOM-based) | A flaw in the site lets attacker input execute as script | The site's own code |
| Third-party supply chain | A vendor whose tag you load ships malicious code — by breach or acquisition | The vendor (Polyfill.io is the canonical case) |
| Expired / lookalike domains | An attacker takes over a domain your page still loads scripts from | The dependency chain |
| Tag manager abuse | A compromised tag-manager account injects "just another tag" | Your marketing stack |
| Client-side malware / extensions | Script is injected on the visitor's machine, into every site | The visitor's browser |
The first path is a coding flaw you can fix. The middle three are trust flaws: the code was invited in. A modern page runs dozens of third-party scripts, and every one of them is an injection vector with full page privileges — the core problem of client side security.
What injected scripts do
Injected code has no privilege boundary separating it from your own. In observed attacks it skims payment forms character by character, harvests credentials from login pages, overlays fake payment fields on top of legitimate ones, hijacks affiliate revenue, redirects sessions, and beacons the stolen data to attacker infrastructure — often domains named to look like the ordinary adtech in your network tab.
Prevention: reduce the paths
- Fix the XSS class: output encoding, safe sinks, sanitization, Trusted Types.
- Constrain sources with a Content Security Policy: a strict, nonce-based CSP blocks unauthorized script origins — with known limits: it cannot judge what an allowlisted script does after loading.
- Pin what you can: Subresource Integrity for static dependencies; minimize the tag-manager blast radius.
- Shrink the dependency tree: every removed third-party script is a removed injection path.
Detection: watch the runtime
Prevention reduces probability; it cannot reach a trusted vendor's compromise. Detection has to happen where injection lands — the browser. cside's script monitoring inventories every script that executes in real sessions, analyses payloads, and alerts on new domains, changed code, and unexpected data flows. On payment pages that runtime inventory is also a compliance requirement: PCI DSS 4.0.1's 6.4.3 and 11.6.1 exist precisely because injected payment-page script is invisible to every server-side control.
