It gets even scarier with frameworks like nw.js where you can just execute native code directly from the DOM.