I had a flash ad take 100% of my cpu back around 2005 or so. It wasn’t even trying to be malicious, just a poorly made ad. That was the day I stopped allowing any site exceptions in my ad blocker.

Of course 100% of that cpu is probably 1/10 of one core on any of my modern machines, so an ordinary and not-broken ad laden page routinely eats several times as many cycles now. Progress!

Websites can also use 100% of your CPU as well.

You might not be aware, but this is a trivial thing to do.