Bad actors in this case are not exclusively malware authors. Among others, they include the developers of Skype, Java, Adobe Acrobat, most antivirus software...

Bad actors in this case are not exclusively malware authors. Among others, they include the developers of Skype, Java, Adobe Acrobat, most antivirus software... EDIT: For a more specific example, at various points in the past local native apps like uPlay have been exploitable such that random websites could drive-by execute scripts or download malware. Pretty much any native app (legit or not) could potentially load an extension or install a protocol handler that lets a random website own your machine.