citation for your exploits claim ? you've worded it in an awkward manner that makes it sound like a red herring

specifically, are there javascript-only (or js+css+html only) exploits in recent chrome or firefox ?