It sounded like a pretty major bug to me. Essentially a website could hijack the entire browser before now, presumably forcing the user to restart the app. For quite some time, Chrome and Firefox have had that little checkbox on alerts, stopping the site sending any more.