For better or worse (better, I'd argue), I don't think browsers want you to drive the browser for the customer. My takeaway from most modern browser security developments is that if you can't do it with the standard APIs, you aren't supposed to be doing it.
