Unfortunately, it can be a vector[0], especially on less security focused software that has less sandboxing.

0: https://www.cvedetails.com/vulnerability-list/vendor_id-7294...