a method for protecting a mashup webpage is disclosed . the mashup webpage includes a plurality of mini - applications . the method includes intercepting a content access event by a first mini - application of the plurality of mini - applications , the content access event requesting access to content of a second mini - application of the plurality of mini - applications . the method also includes ascertaining , using a document mini - application model access control policy and a dom model , whether the content access event is permissible . the method additionally includes denying the access by the first mini - application to the content of the second mini - application if the content access event is deemed impermissible or permissible according to the dom access control policy .