Sandbox user javascript

[casey]

What are we worried about here?

• JavaScript accessing extensions like metamask. Doesn't seem like web worker can do this. Plugins are instantiated in document or main JS context.
• JavaScript making requests on local area network.
• Insert malicious links into the dom and make it look like they came from us, making users more likely to trust/click them (not possible, afaict from the web worker, because no DOM access)
• Exploiting current page origin. (Not an issue because current page origin doesn't have special privs or cookies.)

Currently, running scripts in a web worker seems secure enough. We should wait on changing our current setup to an iframe until we have a clear threat model we need to defend against.