Indeed, with all the CPU sidechannel attacks that just came out, allowing any untrusted code to run on your machine, even sandboxed in a browser, seems like a horrible idea.