The problem here is that localStorage/WebStorage already creates an IPC mechanism. You're able to create objects, and other pages in the same domain can read th

The problem here is that localStorage/WebStorage already creates an IPC mechanism. You're able to create objects, and other pages in the same domain can read them. Add another object as flow control, and you have all the primitives you need. In fact, I'd argue that the current situation is more insecure, because it is an ill-defined backchannel instead of something formalized. Regarding the audio issue, I think this hits up a greater issue. Browsers should have a permission dialogue for things like audio and video that work on a per-domain basis so you can control that behavior. Sometimes you want to have background audio from pages. Most of the time, it's annoying. Asking would fix that problem, even when the user initiates a touch event.