While that might be an "easy way" - it isn't a secure way in this case.
Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function.
And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname
Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function. And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname