[Piskvorrr]

It is much easier when being nice is enforced by a third party - in other words, the webpage might have an interest in taking all your cycles, but the browser app has an interest in the opposite (battery life and whatnot). So far, this seems to work well - for all the gripes of FB Messenger taking all the CPU and requiring every permission in the known universe, the FB mobile web gets adequately sandboxed by the browser.

(I am aware that the Android app model has also promised some sandboxing, but apparently even in a low-permission mode, the protection seems to be rather anemic)