It is well-known that third-party JavaScript inclusion is risky, I wonder what actual damage can be caused if the third-party script is malicious. Of course the script can cause as much damage as possible to its own DOM, other than that, can it affect other DOMs, can it cause any damage to the browser or the host computer?