If it can modify the DOM or even display its own HTML-based UI, that might be hard because it can embed an external image, and the loading of that image would contact an external website.