It doesn't need to be that hard. A reasonable solution is to quarantine the tab/app. Proactively revoke its network access after its loaded.