Hacker News Reader

Many browser exploits that break out of the sandbox take advantage of javascript. Disabling it prevents entire classes of exploits. Also, a lot of ad networks use javascript as a tracking tool.

View on HN

After about 20 seconds of googling

chrome: https://www.cvedetails.com/cve/CVE-2011-1186/

firefox: https://www.cvedetails.com/cve/CVE-2015-4509/

I don't think most people would consider 2011 recent.

citation for your exploits claim ? you've worded it in an awkward manner that makes it sound like a red herring

specifically, are there javascript-only (or js+css+html only) exploits in recent chrome or firefox ?

Reply on news.ycombinator.com