Could be in a service on a server, which in this case a RegEx DOS could lock the server for all users.
Or if a JS frontend takes in input that comes from other users-- something like forum post titles or content.
That's "just" a browser freeze for end users, but still a potential DOS vulnerability if it's in the application's critical path.
Right, but that's why I wrote "context," and seems to be the primary complaint in this article.
But in this context what's the end result? Chrome locking up on the end user's (attacker's) machine? Again, an "attacker" doesn't have access to the source code for distribution. By inputting bad regexp data they're only DOSin themselves, no?