I worked on this feature for Chrome on Android, and this is our current approach. Vibration will stop when the user:
* Navigates away
* Reloads the page
* Switches to a different tab
* Closes the tab
* Sends the browser to background
* Turns the screen off

It should also not start at all if vibration is turned off for the phone as a whole i.e. it’s on silent.

There are also limits to how long the device will vibrate.

Try it out here: http://jsbin.com/UKamoNID/1

Also, if the user doesn’t like the page, he can close it and not go there again. It is the most basic way of user control in a browser, and proven to be quite effective. If it turns out that this feature really does get abused a lot, like browser popups did, then we’ll have more data. This would give better insight into how to counter the abuse without degrading the user experience for valid usage.