The Same Origin Policy can be overridden by the site accepting the connection (h...

		ianb on Feb 4, 2013 \| parent \| context \| favorite \| on: Hello Firefox, this is Chrome calling The Same Origin Policy can be overridden by the site accepting the connection (http://www.w3.org/TR/cors/), so assuming that site is hosted by the attacker it wouldn't be helpful. If the site used (and the browser supported) a Content Security Policy (http://www.w3.org/TR/CSP/) you could restrict such outgoing connections.