All of this means, assuming the above JavaScript code was placed on a web server, reachable at host:8080, an attacker could sneak in a GET parameter representing the invisible variable, in its URL ...

Meanwhile, Instagram can even detect all text selections on websites. ... After all, JavaScript code is commonly used for debugging, troubleshooting, and monitoring the performance of a web page.