any browser that allows you to mess with the DOM of the page via javascript, any browser for which CGI::Ajax is going to work at all (the premise of this discussion).

If you can add elements, you can add script elements. And there's no way the browser can distinguish between script elements your javascript is generating out of whole cloth vs script elements that are being blindly copied from some other site