[megous]

They did not write about it though.

Web Workers were used for running untrusted plugins in the past. They run off-the-main-thread, are terminateable, don't have access to DOM, etc.

You'd still need to cleanup their environment, before running untrusted code there. It's some challenge, but not too hard.

The only trouble is that they're hard to monitor for abuses of CPU/Memeory use. But that will at most crash your browser.