The cost-benefit analysis of JavaScript usage comes down on the side of enabling it for most people, because of how much of the web is completely broken without it. Sandbox escapes are rare but extremely valuable, and they absolutely exist: https://www.computerworld.com/article/3186686/google-patches...