Jscrambler

03/11/2026

Consent is not control.

A cookie banner can be configured correctly, and data can still leave the page: a hardcoded tag fires before the choice, an approved vendor reads data it was never meant to see, or a script changes after the audit.

New on the blog: why cookie banners don't stop data leakage, and what does 👉 https://eu1.hubs.ly/H0zCgPV0 🔗

Going deeper live on 10 Nov https://eu1.hubs.ly/H0zCgPW0 📥

02/11/2026

🚨 $2.7M stolen through a third-party script hack targeting Polymarket users.

The incident highlights a critical security gap: trusted third-party scripts can become an entry point for attackers, putting users and sensitive data at risk.

In his commentary for https://eu1.hubs.ly/H0zB1XB0, Gareth Bowker, Head of Information Security at Jscrambler, explains why traditional protections like Content Security Policy (CSP) and Subresource Integrity (SRI) aren’t always enough - and why runtime monitoring of third-party code is essential.

Read the full story and Gareth’s insights at Hack Read https://eu1.hubs.ly/H0zB1XC0🔗

Press Release Guardz Brings Palo Alto Networks Prisma Browser Protection to Small Businesses Miami, United States, 2nd November 2026, CyberNewswire byCyberNewswireNovember 2, 2026

27/10/2026

🤖 What is your AI agent reading before your user even types a prompt?

AI governance often focuses on models, their outputs, and API access. But what about the data AI-powered scripts collect before a prompt is even sent?

Running in the browser, these scripts can access form fields, session tokens, browser storage, and sensitive application data - potentially before users even interact with an AI feature.

The result? Blind spots in data privacy, regulatory compliance, and competitive security that traditional AI governance controls may not address.

In our latest blog post, we explore why AI data governance needs to extend to the browser layer, and the three capabilities organizations need to close the gap:

🔍 Continuous AI script discovery and data access mapping
🛡️ Runtime data access enforcement
📋 Audit-ready runtime evidence

Read the full article to understand the risks and how to strengthen AI data governance at the source.

👉 Read it now at Jscrambler's Blog https://eu1.hubs.ly/H0zqJ9K0

Most enterprise AI governance programs focus on the model: what it was trained on, what it produces, and who can use it.

15/10/2026

When a banking website leaks customer financial data to third-party trackers, whose fault is it?

Big Tech claims website owners are responsible for what tracking pixels collect. But in practice, those third-party pixels ship with aggressive data capture turned on by default.

When a banking site leaks customer financial data, whose responsibility it is comes under the spotlight.

Jscrambler’s Head of Information Security, Gareth Bowker, recently broke down this issue for TechRadar. The team tested 14 major banking sites across the US and Europe and found 9 of them actively leaking sensitive info (think loan amounts and tax IDs) straight to third parties.

Some of this was happening even when users explicitly clicked "reject all" on the cookie banner.

When confronted, ad platforms are quick to point the finger at website operators. They claim they only collect what banks tell them to. But anyone who works with these pixels knows they are built to capture a broad scope of data by default.

Here is the reality for financial institutions: "We didn't know the script did that" won’t satisfy a regulator.

While advertising platforms carry the blame for their overly broad default settings, the compliance burden and the duty to protect customer data ultimately fall on the website owners:

- You chose the vendor.
- You put the consent banner in front of the customer.
- You deployed third-party defaults into highly sensitive workflows.

Blindly trusting third-party tags creates significant operational and compliance risks.

Stop assuming marketing scripts behave exactly as configured, and start verifying what they actually do at runtime.

Read Gareth’s full breakdown in TechRadar Pro on how security and privacy teams can close the gap before regulators step in. 🌐https://eu1.hubs.ly/H0z6GP90

Banking sites leak financial data via tracking scripts despite consent

13/10/2026

We're gearing up for the PCI SSC Europe Community Meeting. 💳

Meeting PCI DSS requirements 6.4.3 and 11.6.1 is essential to avoid regulatory penalties and pass regular audits, but checking the compliance box is only the baseline for a modern security strategy.

Treating client-side security purely as an annual assessment milestone leaves critical vulnerabilities open in the ex*****on layer where sensitive data lives.

By moving beyond simple change detection to continuous, real-time client-side governance, organizations protect customer trust, secure intellectual property, and turn compliance requirements into a foundation for comprehensive digital security 👉 https://eu1.hubs.ly/H0z1QXq0

Client-side security tools, agent-based and agentless solutions for PCI 6.4.3 & 11.6.1 compliance, & prevention of digital skimming attacks.

12/10/2026

That’s a wrap on IAPP Privacy. Security. Risk. + AI Governance Global 2026! 👋

We had a great time in Seattle connecting with privacy, security, and data governance leaders.

Thank you to everyone who stopped by to meet with the Jscrambler team and shared their perspectives on privacy, security, compliance, and the evolving risks of AI.

A special thanks to Sean O'Leary, Bryan Powell, Tyson Whitten, Nathan Coppinger, and Gareth Bowker for representing Jscrambler in Seattle.

Until next time! 👋

05/10/2026

Happy Monday! ⛅

Make sure to subscribe to our monthly newsletter to receive all the latest news on Jscrambler's initiatives and products. We bring you the latest on client-side protection, PCI DSS v4.0 compliance, and JavaScript-related tutorials. 📰

Subscribe now at https://eu1.hubs.ly/H0yHnr00

Jscrambler is the leader in client-side protection. Subscribe to our newsletter to receive all the latest news on Jscrambler's initiatives and products.

29/09/2026

Your SBOM shows what you built. Your vendor questionnaire shows what they promised.

Neither shows what third-party scripts are doing in your customers' browsers right now. ⬇️

That's the gap Magecart-style attacks exploit: a vetted vendor script gets compromised upstream, and no build-time scan or assessment catches it.

Our latest post explains why supply chain security stops one step too early, and how to extend it to runtime. Read it now at Jscrambler's blog https://eu1.hubs.ly/H0yHP5y0 📘

Software supply chain security and third-party risk have a starting line. They have no finish line, but programs are built as if they do.

25/09/2026

At IAPP Privacy. Security. Risk. + AI Governance Global 2026, we’ll be talking about the growing gap between privacy policies and what actually happens in the browser at runtime.

Pixels firing before consent, third-party scripts expanding their data collection, and AI agents accessing data they shouldn’t - these are runtime problems that a CMP alone can’t fully address. ⤵️

Join Jscrambler in Seattle on October 8–9 to learn how runtime enforcement can help close this gap and protect data where it matters: in the browser. 💻

You can meet the team at the event: Sean O'Leary, Bryan Powell, Tyson Whitten, Nathan Coppinger, Gareth Bowker 👥

📍 Seattle Convention Center
🗓️ October 8–9, 2026

Planning to attend? Let’s connect at https://eu1.hubs.ly/H0yCwCR0 🔗

**A

Join us at IAPP 2026, where the global media, entertainment, and technology community comes together to shape the industry's future.

22/09/2026

C**A litigation is shifting, not disappearing ⬇️

If passed, California SB 690 will curb pen register lawsuits, but §631 wiretapping claims against tracking pixels, chatbots, and session replays remain an active risk.

For organizations operating websites with visitors in California, that means website tracking and third-party scripts are still under scrutiny.

And a CMP alone isn’t enough.

A CMP records consent. Runtime enforcement helps ensure it’s actually enforced in the browser.

Our latest blog by Nathan Coppinger breaks down 5 steps to help reduce C**A litigation risk - including why organizations need to move beyond passive consent management to active browser runtime enforcement.

👉 Read it now at Jscrambler's blog https://eu1.hubs.ly/H0ywVZL0 📘

**A

C**A is being weaponized by plaintiffs’ attorneys against modern website technologies like tracking pixels, session replays, and chatbots.