title: Can a JavaScript hosted on different domain read/modify DOM of another domain?
body: <p>I have a question regarding a potential security issue/limitation regarding JavaScript hosted on a domain (ex: domain of a CDN, say example.com), but loaded from a website under a different domain (say, example.net).</p>
  
  <p>Now imagine that the JavaScript loaded will just read/modify text in a <code>div</code> with a particular id, so nothing "complicated".
  An example: I have the script loaded from <a href="http://example.com/myscript.js" rel="noreferrer">http://example.com/myscript.js</a>, and executed on <a href="http://example.net/index.html" rel="noreferrer">http://example.net/index.html</a>: [note the different TLD!]</p>
  
  <pre><code>&lt;!-- Page example.net/index.html --&gt;
  &lt;script src="http://example.com/myscript.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>I know that I can't access Cookies under mysite.com from the JavaScript, but I can access all the DOM on the page and in case, modify it.
  Isn't this a possible security issue? Shouldn't this trigger the same-origin-policy protection?</p>
  
  <p>Are there user agents that prevents a JavaScript hosted on a different domain to access elements in the page that executes the script?</p>
  
  <p>And, moreover, will the example above work also on HTTPS pages? (ex: <a href="https://example.net/index.html" rel="noreferrer">https://example.net/index.html</a> loads the script from <a href="https://example.com/myscript.js" rel="noreferrer">https://example.com/myscript.js</a>)</p>