A browser shows a warning: 'Mixed Content: The page at https://secure.example.com was loaded over HTTPS, but requested an insecure resource http://cdn.example.com/script.js'. Why is this a security problem?

• A.Loading web fonts (WOFF2 or TTF files) over HTTP on an HTTPS page changes rendering speed and can briefly show fallback system fonts, and modern browsers still permit the request without showing a mixed-content warning to the user
• B.Loading active content (scripts, iframes, forms) over HTTP on an HTTPS page undermines the entire page's security - an attacker who can MITM the HTTP request can inject malicious JavaScript that executes with full access to the HTTPS page's DOM, cookies, and credentials
• C.Loading images (JPEG, PNG, or animated GIF) over HTTP on an HTTPS page triggers a passive mixed-content warning in the browser console, and the browser still renders the image fully without blocking the rest of the page load
• D.Loading a stylesheet (external CSS) over HTTP on an HTTPS page lets an attacker who intercepts the request rewrite selectors and override visual styling, and while this can spoof form fields or hide security warnings visually the browser still classifies it among passive content needing no warning