Not only that, but JavaScript can get you owned, and any code loaded over a non-https connection could be rewritten in transfer. Remember: all Tor exit IPs are publicly known. Tor users are easy to target.

If you use .onion services for anything... interesting, you should also be aware that the first step an advanced attacker might do with a compromised site is to try and completely own all browsers visiting.

If you run JavaScript, you're just waiting for someone to poke a hole in whatever sandbox protections the Firefox base of Tor Browser can provide. Example: https://threatpost.com/tor-browser-update-critical-flaw/1458...