> If you don't see the contradiction between these two statements, I don't know how to help you.

Just because it's in a browser doesn't mean it's remote access. Javascript APIs can be accessed locally.