Its not even strictly privacy violation, but carelessness. Google would never enable something like this(raw calling someone elses unvalidated library) internally, yet its a wild west when it comes to browsers running on user computers. How did we get to the point where browser will happily leak available C drive free space with one stupid navigator.storage.estimate() call.