[superkuh]

My ISP Comcast (rebranded to Xfinity to avoid all the negative associations with it's actual name) does man in the middle attacks on HTTP connections and injects javascript code into webpages. I actually had this happen to the steam browser back in ~2013 and I had to restart it. But they still do it today in 2026. I don't use a commercial VPN because I host from home. But I do tunnel my HTTP browsing to a remote VPS I rent.

[MrDrMcCoy]

They also block 3rd-party DNS in many cases, forcing you to use theirs so they can sell your activity more completely.