The problem is not only permissions. The problem is that code execution model within anything a mile close to web and browsers is a security threat by itself.