On: The XSS Game by Google

[Buge]

>For example, if browsers flatly refused to load code from an external URL unless the address was whitelisted in the page's HTTP response headers

That wouldn't just break some old sites that would break most of them. Most sites use some type of tracking script, jquery or other shared library.