Even without web stuff there are many apps, and there is one keyboard and there are going to be key binding conflicts.
Webapps may need low(er) level access to keyboard for legit reasons too. Years ago I was working on webapp that teaches 10-finger typing. It needed to know 'pressed' states of keys like Shift and Alt. There were various browser differences to work around. Luckily the app didn't need to support Polish layout.
So make it opt-in, and highly visible to the user when it happens.
I get a nag screen when videos in the browser go full screen, telling me loud and clear that expected behaviour is changing and telling me how to get control back. When a website overrides keyboard controls, the first I know about it is when I can't scroll properly, or switch to another tab, or go back, or close the window that's yelling at me and making my machine thrash ...
Disruptively changing modes without notification violates fundamental rules of interaction design, affordances and basic security. How is that okay?
Webapps may need low(er) level access to keyboard for legit reasons too. Years ago I was working on webapp that teaches 10-finger typing. It needed to know 'pressed' states of keys like Shift and Alt. There were various browser differences to work around. Luckily the app didn't need to support Polish layout.