Daniel Kulbe
--- a/src/EventSubscriber/HtmlResponseSubscriber.php
+++ b/src/EventSubscriber/HtmlResponseSubscriber.php
    }
  }

+  /**
+   * Adds crossorigin attribute to script tags.
+   *
+   * @param \Drupal\Core\Render\HtmlResponse $response
+   *   The HTML response to update.
+   *
+   * @see https://www.w3.org/TR/2014/REC-html5-20141028/scripting-1.html#attr-script-crossorigin
--- a/src/EventSubscriber/HtmlResponseSubscriber.php
+++ b/src/EventSubscriber/HtmlResponseSubscriber.php
    }
  }

+  /**
+   * Adds crossorigin attribute to script tags.
+   *
+   * @param \Drupal\Core\Render\HtmlResponse $response
+   *   The HTML response to update.
+   *
+   * @see https://www.w3.org/TR/2014/REC-html5-20141028/scripting-1.html#attr-script-crossorigin
+   */
+  protected function addScriptCrossOrigin(HtmlResponse $response) {
+    $content = $response->getContent();
+    foreach ($this->settings->getDomains() as $domain) {
+      $pattern = '/<script src="(?:https?:)?\/\/' . quotemeta($domain) . '\/.*"/';
--- a/src/EventSubscriber/HtmlResponseSubscriber.php
+++ b/src/EventSubscriber/HtmlResponseSubscriber.php
+      $pattern = '/<script src="(?:https?:)?\/\/' . quotemeta($domain) . '\/.*"/';
+      $content = preg_replace_callback($pattern, [$this, 'updateScriptTag'], $content);
+    }
+    $response->setContent($content);
+  }
+
+  /**
+   * Callback to replace individual script links.
+   *
+   * @param array $matches
+   *   Array from matches from preg_replace_callback.
+   *
+   * @return string
+   *   Updated html string.
+   */
+  protected function updateScriptTag(array $matches) {
-  protected function updateScriptTag(array $matches) {
+  protected static function updateScriptTag(array $matches) {