<script> window.onload = () => { a.addEventListener("DOMSubtreeModified", () => { document.body.appendChild(b) document.body.removeChild(b) window[1] }) a.type = "" } </script> <embed id="a"> <iframe id="b"></iframe>