This is a fundamental problem with running arbitrary untrusted code on your machine. Things like your display size and desktop decorations suddenly become security-relevant.

Browsers need to start recognizing these as high-priority security vulnerabilities and make it a point to preempt them by design. Or they need to explicitly acknowledge that they cannot and start reducing their javascript attack surface to a simpler foundation more appropriate for interactive web pages.

Code running for a web page should have no idea of what size screen or aspect ratio it is displaying on - if a developer wants to draw pixel perfect graphics, they should be creating an app. Many better methods exist for distributing full-featured programs to run on one's machine - they generally involve auditing by a third party. Sandboxed execution is a nifty thing, but it's negligent to assert that it's infallible and eschew further security measures.