JavaScript in the browser have no “sandbox” to evade. It does not have the ability to run outside of it’s virtual machine, at all. It’s completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.

Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It’s just not efficient enough.

Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.

The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.

It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.

The microsoft thing worked. It also highlighted a lot of issues that would also exists in space, but way worse.

But “genius billionaire buffoon” can’t read apparently.