I don't think we need to go quite that far. I think one of the issues is that browsers tend to entirely neglect the context of Javascript. They treat a comple

I don't think we need to go quite that far. I think one of the issues is that browsers tend to entirely neglect the context of Javascript. They treat a complex webapp the same as they treat a simple website that has jQuery for drop down menus, despite the fact that the expectations should be substantially different. The former should absolutely have some kind of security notification similar to installing an app: "this page wants permissions X, Y and Z". You can either accept those permissions and use the app, or decline them and the app can decide whether to just not work or to disable some features that rely on those permissions. The latter should have an extremely minimal set of features. Probably just the ability to manipulate the DOM. The second it crosses into something as basic as AJAX requests, it now needs a different security context and the user should approve that. It now has the ability to exfiltrate data from your PC. The blurring of lines between a web page and a web app has been great in many ways, but security on that front just doesn't seem to have moved much.