How does Google's javascript API get around the cross-domain security in AJAX

Question

How does Google's API make cross-domain requests back to Google, when it's on your website?

Answer 1

They get around it by dynamically injecting script tags into the head of the document. The javascript that is sent down via this injection has a callback function in it that tells the script running in the page that it has loaded and the payload (data).

The script can then remove the dynamically injected script tag and continue.