Here, the attacker runs first. "defer" attributes are only used to enforce script insertion order. A firefox bug gets on the way of my attacker script. It works fine on Chrome though.