You don&#x27;t know - which is why javascript needs to be whitelist-only, no exceptions.<p>&gt; performance-related reasons<p>Security is always more important than performance. It&#x27;s irresponsible to sacrifice security simply to make page loads faster.<p>Some of these problems can be worked around in the future with authenticated hrefs (such as with a hash-check aka subresource integrity).