how would that be enforced? unless extensions now be required to be WASM blobs, or otherwise using some very simple runtime. (ie. not JS/Node) I think we learned this with the JVM (applets) and the Flash player.

Is there no setfenv-like functionality in JavaScript (setfenv is Lua's way to set a sandboxed execution environment)? That's surprising. TIL.