> Even Chrome won't have mitigations to this that prevent iframes from other origins doing this attack for a week or 2

You can enable (experimental) Chrome process separation here:

chrome://flags/#enable-site-per-process