JavaScript. Web browser controls only work if the page uses the standard APIs. Much of the reason browser's don't block simple things is that advertisers will

JavaScript. Web browser controls only work if the page uses the standard APIs. Much of the reason browser's don't block simple things is that advertisers will happily write a memory-hogging CPU-hogging virtual machine to force the feature to run anyway. You can't win by trying to control what hostile code does after you let it run. Block untrusted domains from running code on your machine.