The JavaScript single-page application I am maintaining opens most of the times in iframes created inside pages of our customers' sites.
Our SPA features a brutal override of window.onerror, as I want to be notified on my server of all JS errors happening during the execution of my code.
window.onerror = my_global_error_handler;
When JS code fails I record the domain where it came from. I'd expect that all errors be generated from code coming from my company's domain. However, in some cases I get errors generated from JS code loaded from other domains. I wonder how this is possible, as I expect that my error handler be unable to catch errors outside the iframe where my code is executing.
Since most of the "foreign" domains mentioned in my logs are various viral e-marketing companies, I wonder whether some smart kid is managing to inject code in my iframe.
Another hypothesis is that some browsers may be overriding the top window's error handler when I override the one of the inner iframe window.
What could be happening?