Subset of JS permitted in a policy-declared Iframe, similar to CSP, limited to merely fixed rendering, no networking whatsoever, save the initial script exec. Ads go in here, or browser blocks them by default, as a spam-like prevention measure.