1. A computing device comprising: a processing element that includes a masking mechanism; a computer storage medium encoded with instructions that when executed by the processing element cause the computing device to perform operations comprising: receiving from a client application within a web browser on the computing device a request to download a native code module; and responsive to the request, downloading the native code module over a network, loading the native code module into a secure runtime environment in the web browser, and executing instructions in the native code module in the secure runtime environment and directly on hardware of the computing device, wherein executing the instructions includes masking, by the masking mechanism within the processing element, one or more bits of a target address during a control flow transfer to transfer control to a restricted set of aligned byte boundaries in the native code module.