With a proper permission system in place, sure. Desktop apps got the permission model all wrong. You run a program and that grants them access to everything.

With a proper permission system in place, sure. Desktop apps got the permission model all wrong. You run a program and that grants them access to everything. The web's model is closer to that of mobile apps. It asks for a permission at the time that it's needed. Not all sites get this right, but browsers are starting to crack down on requests the moment you enter a site.