Browser 0-days still often run on user priviledges. The moment you get code-execution on a vulnerable Intel CPU that turns into hardware level access.

And like the other commenter said, there are also JS implementations.