Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.
Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
JavaScript in the browser have no “sandbox” to evade. It does not have the ability to run outside of it’s virtual machine, at all. It’s completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.
Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It’s just not efficient enough.
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.
Still can have issues with javascript crypto miners. And there’s always the possibility of malicious javascript finding a way to escape its sandbox and escalate permissions.
JavaScript in the browser have no “sandbox” to evade. It does not have the ability to run outside of it’s virtual machine, at all. It’s completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.
Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It’s just not efficient enough.
Most (all?) browsers throttle tabs that take too much cpu for too long (especially background). The actual numbers vary, but hidden cryptominers are not that effective anymore.