A recent addition to HTML5, the Fullscreen API, appears to be easily abused.