Firefox did not have process-level sandboxing till Quantum. Exploit a JS bug in the renderer and you had code execution on the host OS.

"Fake news" accusations aren't welcome on HN, people here prefer to disagree amicably.