On the topic of Html 5 , here is a nice How to Safeguard your Site with HTML5 Sandbox article which comes with a https://github.com/writeline/HTML5-Sandbox-Demo sample.
Also really good is the Defense in Depth: HTML5 Sandbox page from Microsoft's IE team which shows a couple vulnerabilities (and how they can be mitigated):
One question I have on these Html 5 protections is: What about ClickJacking?