[gowld]

JavaScript. Web browser controls only work if the page uses the standard APIs.

Much of the reason browser's don't block simple things is that advertisers will happily write a memory-hogging CPU-hogging virtual machine to force the feature to run anyway. You can't win by trying to control what hostile code does after you let it run. Block untrusted domains from running code on your machine.

[mratsim]

It's probably easier to run a JS script to mine crypto than a virtual machine to run a video ad though.