Nice works.
Please note it does not detect (and block) the code embedded in a url through the
"data:text/html" directive.
I don't know if this method it's exploitable in a web page

example: paste the following code on your navigation bar
(It's a dots wave single pixel plotter, so it uses getImageData and it works even if you block the readout API):

edit: sample code moved to pastebin (sorry, pasting the code here does not works):
https://pastebin.com/pFvdgKNN