The website an organization deploys is not necessarily the complete page its customer receives. In the browser, a page can be assembled from scripts, styles, images, APIs, tag managers, analytics platforms, payment services, customer-support tools, and other resources outside the primary application stack.
Modern websites depend on third-party code. That dependence creates an inventory and governance problem: server inventories and vendor registers alone cannot describe the complete environment operating in a customer's browser.
These findings describe browser-visible complexity. They do not label any included organization vulnerable, compromised, unsafe, or non-compliant.
A page is a runtime composition
The browser recorded a median of 107.5 Resource Timing entries per observation. The interquartile range was 57.8 to 174, and the observed range was 1 to 445.
Resource Timing is not a complete network transcript. Redirects, caching, service workers, browser implementation details, buffer behavior, and the collection window can affect what appears. Even within those limits, the distribution shows why browser-side discovery matters.
The registrable-domain boundary
The observed pages contacted a median of eight registrable domains other than the final page's registrable domain. The interquartile range was 4 to 18.3, with an observed maximum of 64.
This boundary is a reproducible technical proxy, not a corporate-ownership test. CDNs, affiliated services, CNAME arrangements, hosted infrastructure, and separately branded providers can make technical and organizational boundaries differ.
Script entries crossed domain boundaries
In 92 of 100 observations, Chromium recorded at least one Resource Timing entry classified with initiator type script whose registrable domain differed from the final page.
This does not mean 92 percent of websites are unsafe. It does not reconstruct every loading relationship, identify ownership, prove code execution, or determine internal approval. It records what the browser exposed under a fixed study definition.
Control presence is not control quality
An enforced Content-Security-Policy response header appeared in 45 observations. A report-only header appeared in 11 observations, with possible overlap.
The study measured header presence, not policy strength. It did not evaluate directive quality, coverage, nonce or hash implementation, bypass resistance, reporting completeness, or effective protection.
Integrity attributes appeared on a minority of in-scope pages
The final DOM contained at least one cross-registrable-domain script src element in 92 observations. Of those, 26 contained a non-empty integrity attribute on at least one such element.
This is an attribute-presence metric, not a verdict on Subresource Integrity adoption or quality. Dynamic scripts and modules can fall outside a final-DOM element view.
From inventory to governance
Discovery
Maintain a current view of providers, resources, loading relationships, destinations, browser capabilities, performance context, and history.
Control
Set clear defaults for newly discovered resources and make appropriately granular decisions at global, provider, and resource levels.
Evidence
Retain records of what was observed, which decisions were made, what changed, and how issues were investigated.
PCI DSS v4.x Requirements 6.4.3 and 11.6.1 create specific operational attention around payment-page scripts, authorization, integrity, and change detection. GDPR and ISO/IEC 27001 have different scopes, but current inventories and traceable evidence can support privacy, security, and audit work.
SiteWall is CellWall's product response to this operating problem. The product did not generate this study's measurements. The research used standard Chromium and Playwright browser evidence so the method could be documented independently of SiteWall telemetry.
What this research establishes
In this deterministic set of 100 qualifying public-homepage observations, the browser commonly recorded a complex resource surface spanning multiple registrable domains. Cross-domain script resource entries appeared in most observations.
The study does not estimate the entire web or evaluate authenticated flows, checkout journeys, repeated visits, consent-state differences, regional variation, provider ownership, vulnerability, compromise, data exfiltration, or compliance.
The practical question for website owners is whether the organization can discover what the customer's browser receives, control the behavior that matters, and prove how that environment is governed.
Disclosure and citation
CellWall develops the commercial SiteWall product and designed and executed this study. Only aggregate results and the anonymized dataset are published. Identified domain-level observations are excluded from public distribution.
Suggested citation: CellWall, “State of Client-Side Exposure 2026: What 100 public-homepage observations revealed,” September 5, 2026.