Say there is a web page with two 3rd party javascript URL scripts embedded in it. One creates a support chat window and the other creates an iFrame within which a user enters payment information into a form.
If the support chat script was compromised and could it get access the payment information? e.g keystroke logging on the page or directly accessing the form information