Browser Patch to Prevent Cross-Site Scripting Was Deployed to Entrench Big Tech (gigablast.com)

If one bit of js can query google and bing, what hinders an evil developer to query my current session of my banks website? Or my <your favourite online store> account?