Methods, media and systems for screening content for malicious content in a web browser are disclosed. Document object model (DOM) elements are retrieved from the content displayed in the web browser. A link to visit a web site included in the DOM elements is identified. The identified link is compared to a list of permitted sources. Information is scanned to determine whether the information matches records of content transmitted by a primary source among the permitted sources. An alert is generated after determining a mismatch between the information in the DOM elements and records of content transmitted by the primary source.