IMO, browsers should require pages to secure permission (with the user having a per-page option to grant permission one time or permanently on a per-origin basis) before playing sound.