Naclwebplugin _best_ -

NaCl used Software Fault Isolation (SFI). A specialized compiler modified the binaries to ensure code could only execute safe instructions and could never read or write memory outside of its strictly designated sandbox area.

(plagued by zero-day security vulnerabilities) Microsoft Silverlight (proprietary and platform-limited) Java Applets (notoriously slow and insecure) naclwebplugin