Look at my other response in this thread, ROP isn't trivial these days due to ASLR implementations. Almost always one needs information leak bugs.

The presence of a JIT makes things trivially abusable for the attacker and is a big security risk.