Well, this steps up the game quite a lot. I’d considered the CPU attacks relatively unconcerning because it required executing code locally. Bring able execute from a web page makes for a broader attack vector.
JavaScript usually gets JIT'ed into machine language code. That code gets executed locally. There are usually a bunch of differences in terms of form and restrictions around that code, but this might well be a case where most of those differences don't matter.
Or in other words, browsers are just compilers/interpreters like any other, albeit very hardened ones because of the large exposure of untrustworthy code they are subject to. But if an attack fundamentally skirts around sandboxes, the browser sandbox won't help.
It's Turing machines all the way down.