All we need now is to run ActiveX. I think BottledWine can run Windows executables in the browser, how hard would it be to simulate the ActiveX bindings?
That’s maybe enough layers of indirection to make ActiveX safe :-)
This reminds me of the time I was running Linux on my desktop PC back in high school. I'd just received a very suspicious .exe email attachment, and to demonstrate Linux's inherent safety (despite not running any antivirus software!) to a friend, I double-clicked it – and Wine, invoked through binfmt_misc, perfectly emulated the virus it contained, writing garbage to my home directory (fortunately mostly the emulated Windows directories in it!).
Edit: the song is likely it https://youtu.be/JwZwkk7q25I
The only thing I'm missing is the ability to find the easter eggs by hitting the tab key like you could do with Flash...
https://www.destroyallsoftware.com/talks/the-birth-and-death...
The first, real uses cases for XMLHttpRequests was sending chunks of HTML over the wire and updating the DOM via JavaScript - so “Dynamic HTML”