This is a little off-topic but I find it completely baffling that we seem to have so little control over the code that is executed on our own machines. From Javascript on pages to viruses, why is arbitrary software given so much power? Javascript is a dynamic language, so it should be really easy to remove its capabilities. Replace the XMLHttpRequest reference with a stub that requires permission from the user before making any requests. Stub out members on the global object to prevent access to the DOM. Any capability to annoy the user, stub it out. Does this kind of tool not exist in the form of a browser extension? You could define your own script to bork the runtime before control is given to remote scripts.
The theory[1] for this kind of approach was developed over 50 years ago, I'm just completely dumbstruck that we haven't properly solved this problem.
[1] https://en.wikipedia.org/wiki/Object-capability_model