<script>...</script> embedded directly in the HTML.
<script src="first-party.js"> loaded from the same origin.
<script src="cdn..."> loaded from an external domain.
<iframe src="youtube.com/...">.
<object data="test.svg">.
<embed src="test.svg">.
challenges.cloudflare.com
js.hcaptcha.com
www.recaptcha.net