Why does Google prepend while(1); to their JSON responses?

Except that when using a script tag to request JSON content, the JSON is executed as Javascript in an attacker’s controlled environment. If the attacker can replace the Array or Object constructor or some other method used during object construction, anything in the JSON would pass through the attacker’s code, and be disclosed. A valid JSON object, when not enclosed by anything, is not valid in Javascript:

This is however valid JSON:

So, making sure you always return an Object at the top level of the response makes sure that the JSON is not valid Javascript, while still being valid JSON.

Source: stackoverflow.com