Browser Untrusted Code Security

Browsers have mitigations in place, don't they? Aren't they enough, at least on paper?

This is like asking why do web browsers need to sandbox javascript. Giving full permissions to untrusted code is an attacker's dream.

There is a way to do that: don't run untrusted code outside the browser.

You run untrusted code every day you browse the web.

A web browser is an application that safely executes untrusted remote code. It sounds like you don’t want to use a web browser.

I'm pretty sure web browsers are sandboxed and that it has taken a significant effort to get there.

Adding the browser to the mix won't make it much more secure, I fear.

It's not a good idea to rely on the browser being safe when the OS itself is unsafe.

You're talking like android and ios are the only platforms. The downsides of those platforms don't justify a web browser (which should be safe to use) granting excessive capability to untrusted code.

Hilariously awesome.I'm curious whether the multiple warnings about running untrusted code in the browser are necessary. I feel like all websites are already untrusted code, and the browser is quite well sandboxed and protected from anything too bad happening. What is the worst case scenario here for the user within the JS ecosystem, under known avenues of attack, not counting an unknown zero day browser exploit?