it can be fixed but would require herculean engineering efforts, the biggest problem atm is the canvas. most of the other things can be fixed via defaults that are returned to the webapps unless explicit permission to access them is granted. like there is never a reason to return errors for session storage if its disable. just return a memory implementation that doesn't persist beyond the window life. little changes like that would go a long way to removing the bits of information.