A JavaScript embed is external code inserted into a web page so the browser downloads and runs it from another host. It is common in widgets, forms, chat boxes, analytics, and payment tools because site owners can add features without building them in-house. The browser treats the embed as part of the page experience, so it can read page data, modify content, and make network requests.
In cyber security, embeds matter because they widen the trust boundary. If a vendor, CDN, or hosting account is compromised, every page that loads that script may inherit the risk at once. Attackers use this pattern for supply-chain abuse, malicious redirects, credential theft, and payload delivery. Defenders should inventory third-party scripts, remove unused embeds, prefer self-hosted critical components, and use controls such as Content Security Policy and Subresource Integrity to limit unexpected changes.