> and therefore couldn't use the `vm` module from Node.js browsers do have isolated contexts these days, they're just cumbersome to use. 1. spawn an iframe

> and therefore couldn't use the `vm` module from Node.js browsers do have isolated contexts these days, they're just cumbersome to use. 1. spawn an iframe with sandbox="allow-script" and srcdoc="...<meta http-equiv="Content-Security-Policy" ...><script>...</script>..." 2. use window.postMessage to communicate between the parent page and the iframe running in a null origin 3. send code to eval into that iframe