I was thinking a malicious 3rd party JS (say a CDN copy of jQuery or something).