One thing that I've been thinking is that in addition to restricting what APIs JS can access, browser could restrict <i>when</i> JS can run; in practice I guess that'd mean what events are allowed to trigger JS. Most importantly I'd block the stuff that runs automatically in the background, such as scroll/hover/timer events, and allow stuff that represents more explicit user actions such as form submit events.<p>Not sure if such thing would be really feasible without breaking half of the web, but I envision that it could bring nice perf improvements and block many sorts of nasty user behavior tracking