Do they actually have huge performance penalties in Javascript?

I would have thought it wouldn't be too hard to design a capability system in JS. I bet someone has done it already.

Of course, it's not going to be compatible with any existing JS libraries. That's the problem.