Too Long; Didn't Read
Trust in the browser is an all or nothing affair, you either run a snippet of JavaScript in the main document on the main UI thread, with access to every global, to any part of the DOM, or you run it in an isolated environment either an iframe where it is constrained to a small rectangular box or a WebWorker where it can’t directly affect the UI at all.