A method includes emulating a browser in cooperation with a browser controller for providing a controlled environment to safely execute a web program, loading a
web page into the browser, injecting, by executing the browser controller, a first program into the loaded
web page, capturing a first visual representation of a
HTML element of the
web page at a first time after the loading, executing the web page in the browser,
logging, via the first program, an execution of a second program embedded in the web page, capturing a second visual representation of the
HTML element at a second time later than the first time after the execution of the second program, comparing the first and second visual representation to detect a visual change, identifying the execution of the second program as a cause of the visual change, and performing a
remedial action related to the web page in response.