I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine.

It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.

Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.

Oh yeah speaking of popups I once made a horrendous bouncing image script for IE 5.5 that allowed images to fly around your screen outside the browser window.

http://dynamicdrive.com/dynamicindex4/bounceimage2.htm