Isn't it time browser implement a "safe" mode:
- Sharing cookies between tabs? Nope, unless you personally opened it another tab, and expires as soon as you type in a new url.
- Access or url on a different domain ... maybe, but certainly not to localhost.
- Font access ? No
- Plugin listing ? No
- Whatever the hell I don't know about: No.
Then either allow the user to whitelist the site, and/or allow certain parts.
Would it be easy for the user? No.
Would we weed out a lot of issues? At least a few !
I know ... but if you are going to be backwards compatible with security flaws/designs ... cheese ... then it's never ever going to get fixed, and I'll stop bothering making web-apps: no security future!