> the attacker needs to control the network

So like, setup a WiFi with the same name? Or any name known to the device, then deauth. Devices also often broadcast some of the names they know.

> and also exploit a hole in the host browsers.

Well now that depends on your goal. Care to guess how many people could be lured into downloading malware or entering some credentials on a phishing page when they get to it?

I agree it's not like printnightmare level bad, but there's options here.