Exactly my thought when I read the post. While I love the hackability of Emacs, it’s one thing if it’s just your editor with a security hole and another thing entirely if you’re downloading and interpreting pages (and JavaScript?) from the Internet cesspool with a browser with a security hole.