Understanding and mitigating the security risks of content inclusion in web browsers