Comment by koolala

The solution was simple and always possible. It is to make it only work for same-origin content. Aka it can't work for ads or closed source external web content.