[amluto]

The fundamental problem seems to be that you are including non-sandboxed JavaScript that you don’t control.

Perhaps you should stop doing that.

[shostack]

Would something like SafeFrame have avoided this issue?

https://www.iab.com/guidelines/safeframe/