Your team adds a vendor chat widget by pasting a single `<script src>` tag pointing at the vendor's own CDN, and the file it downloads is about 40 KB compressed. Why is the real cost of that widget to the page usually far larger than that number?

## The tag is a loader, not the feature Nearly every third-party snippet has the same shape: a small entry script whose only job is to work out what to fetch next. ```html <script async src="https://widget.example.com/loader.js"></script> ``` That file may genuinely be 40 KB. What it does when it runs is read configuration, decide which locale bundle, which experiment variant and which feature modules this visitor needs, and request them. The number in the vendor's documentation describes the first request in a chain, and the chain is the thing that costs you. ## The network cost A third-party script lives on an origin your page has never spoken to. Before a single byte of it arrives the browser must resolve the hostname, open a TCP connection and complete a TLS handshake. On a high-latency mobile connection those round trips alone often add hundreds of milliseconds, and they are paid again for every additional origin the loader reaches for. Those additional origins are the part teams underestimate. A tag you approved routinely loads code from vendors you never evaluated, commonly called fourth parties: an A/B testing library, an error reporter, a font host, an ad exchange. You approved one relationship and inherited a graph. ## The main-thread cost On a decent connection, downloading is the cheap part. Parsing, compiling and executing JavaScript is what actually blocks, and third-party code gets no special treatment: it runs on the same single main thread as your application. While a vendor bundle is evaluating, your click handler cannot run, your framework cannot hydrate, and any interaction the user attempts sits in a queue. That is why third-party code shows up in interaction latency (Interaction to Next Paint) and not only in load metrics. The cost does not stop when loading finishes. Widgets typically install document-level listeners, timers, and observers that fire on every scroll, click or DOM mutation for the rest of the session. A session-recording script that serialises DOM changes, or a chat widget polling for messages, is a permanent tax rather than a one-off charge. ## The layout cost Many widgets inject DOM after the page has painted: a chat bubble, a cookie banner, a promotional bar. If that injection pushes existing content around, it produces layout shift the user experiences as the page moving under their finger. Reserving space or positioning the injected element out of flow is your job, not the vendor's. ## The dependency you cannot pin A library in your `package.json` has a version, a lockfile, a diff and a code review. A third-party tag has none of those. The vendor can ship a bigger bundle, add a new subresource, or change what runs on your page at any moment, and nothing in your build will notice. Your bundle analyzer cannot see it, because it was never in your build. A CI size check on your own chunks passes happily while the page gets heavier every month. That is the structural point behind the question: this is code you run with full access to your page, whose size, behaviour and dependency graph are controlled by someone outside your release process. ## What to do with that knowledge The interviewer is checking whether you can move from complaint to containment. The reasonable responses are: measure the cost per origin on your own page rather than trusting the vendor's figure; decide deliberately when each vendor loads instead of dropping every tag in the head; keep the ones that must run everywhere as small and as late as correctness allows; and give every vendor a named owner and a review date, so the widget nobody remembers approving can actually be removed. The useful mental model is that pasting a tag is not adding a 40 KB asset. It is granting another organisation the right to run arbitrary code on your page, on their schedule, on your users' devices.