Couldn't this be simple solved with X-Content-Security-Policy header in order to prevent non-authorized domains to run objects on the site ?