Remote code execution + local privilege escalation to own your device. Just last week on the RCE front: https://thehackernews.com/2024/05/new-chrome-zero-day-vulner...
I really don't need push notifications going to my desktop. HTML, CSS... ughhhh javascript...
So if covering javascript is too hard, maybe a HTML/CSS browser, and anytime you need javascript, you open a chrome session.