A computer system comprising: one or more hardware processors; a memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to: at a first time, retrieve and load a first version of a web page hosted on a web server system in a browser comprising a browser extension configured to detect event listeners added when web pages are loaded by the browser; generate first data describing a first set of event listeners detected by the browser extension when the first version of the web page is loaded; at a second time after the first time, retrieve and load a second version of the web page in the browser; generate second data describing a second set of event listeners detected by the browser extension when the second version of the web page is loaded; determine that the web page is compromised by comparing the first data and the second data to identify a change between the first set of event listeners and the second set of event listeners, wherein the change is added at run time between the first time and the second time, prior to loading the second version of the web page; and in response to determining that the web page is compromised, perform a threat response action. one or more hardware processors; a memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to: at a first time, retrieve and load a first version of a web page hosted on a web server system in a browser comprising a browser extension configured to detect event listeners added when web pages are loaded by the browser; generate first data describing a first set of event listeners detected by the browser extension when the first version of the web page is loaded; at a second time after the first time, retrieve and load a second version of the web page in the browser; generate second data describing a second set of event listeners detected by the browser extension when the second version of the web page is loaded; determine that the web page is compromised by comparing the first data and the second data to identify a change between the first set of event listeners and the second set of event listeners, wherein the change is added at run time between the first time and the second time, prior to loading the second version of the web page; and in response to determining that the web page is compromised, perform a threat response action. at a first time, retrieve and load a first version of a web page hosted on a web server system in a browser comprising a browser extension configured to detect event listeners added when web pages are loaded by the browser; generate first data describing a first set of event listeners detected by the browser extension when the first version of the web page is loaded; at a second time after the first time, retrieve and load a second version of the web page in the browser; generate second data describing a second set of event listeners detected by the browser extension when the second version of the web page is loaded; determine that the web page is compromised by comparing the first data and the second data to identify a change between the first set of event listeners and the second set of event listeners, wherein the change is added at run time between the first time and the second time, prior to loading the second version of the web page; and in response to determining that the web page is compromised, perform a threat response action.