egies against various types of attacks.</p>
      <section>
        <h2>Cross-origin script contents</h2>
        <p>
        The API avoids exposing contents of cross-origin scripts by requiring all functions included via the <a>take a sample</a> algorithm to be defined in a script served with <dfn data-cite="HTML5#cors-same-origin">CORS-same-origin</dfn> through the <a>muted errors</a> property. Browser builtins (such as <code>performance.now()</code>) must also only be included when invoked from [= CORS-