> Да все, с которыми работаю.

Ни к каким данным юзера на диске у этих программ доступа нет. Они ограничены песочницей.

> А делать в окне браузера ещё и окно программы... Ну вы поняли.

Программу на HTML можно отобразить в отдельном окне и без "окна браузера"

Native Client can't run any off-the-shelf program compiled for an off-the-shelf operating system.  The program must be compiled to comply with Native Client's rules.  The details vary on each platform, but in general, the untrusted program:

    Must not attempt to use certain forbidden instructions, such as system calls.
    Must not attempt to modify its own code without abiding by Native Client's code modification rules.
    Must not jump into the middle of an instruction group, or otherwise do tricky things to cause instructions to be interpreted multiple ways.
    Must use special, strictly-defined instruction sequences to perform permitted but potentially dangerous actions.  We call these sequences pseudo-instructions.

.., we apply a load-time validator that disassembles the program.  The validator either proves that the program complies with our rules, or rejects it as unsafe.