Javascript can be used to deliver/encode/decode exploit payload. Usually the exploit itself is java or flash.
At least, that's what I noticed for the zero day RCE that made it up to the first page of Google.
For technical users, uMatrix' interface is an amazing achievement in, effectively, managing application firewall rules. It's breathtakingly efficient in both communicating active settings to the user and in configuring new rules. I wish my actual firewalls used that interface.
it's also easy to access: http://cdn2.ubergizmo.com/wp-content/uploads/2012/11/site-in...
i wish firefox came with something similar
Say you randomly visit a site and want to temporarily allow the javascript it uses to do its thing, but you don't want to allow any other javascript on the page such as facebook's and google's. The built-in chrome javascript blocker doesn't let you pick and choose temporary permissions at that moment.
So all the noscript equivalent for Chrome could offer was to block Javascript after it had loaded. Which seemed unreal and pointless.
So I stayed on Firefox. Because I've been convinced for many years now that Javascript plays a major role in malware delivery through the browser.
And along with email the browser is the major delivery platform for malware.