>As a first step, I'd appreciate reducing the risk of javascript extracting contents from outside the browser.

But that means essentially reserving a core for the browser only. I don't think that would be shippable by default.