I execute user-provided javascript code inside iframes. It is possible that the executed code was submitted by a different user, so it needs to be sandboxed as much as possible. The sandbox attribute on the iframe helps a great deal, as does using a Content-Security-Policy for it.
However, I still need a way to prevent malicious code from freezing the website.
I can see two possibilities, but don't know how to get either to work:
1: All code in the iframe is run in a Worker dedicated to that iframe. Unfortunately, the code in the iframe must be allowed to alter the html contained in the iframe. By modifying it so that it loads another script, the code could effectively break itself out of the worker.
2: The code does run in the main thread, but there is a Worker watching over the page. This worker can somehow tell when the website is frozen because of an iframe and then kill only those scripts that are at fault.