> the attacker needs to control the network
So like, setup a WiFi with the same name? Or any name known to the device, then deauth. Devices also often broadcast some of the names they know.
> and also exploit a hole in the host browsers.
Well now that depends on your goal. Care to guess how many people could be lured into downloading malware or entering some credentials on a phishing page when they get to it?
I agree it's not like printnightmare level bad, but there's options here.
I remember Apple having to fix Safari a few years back, related to that type of attack.