it is not the same security context between web/browser apps and desktop apps wether there is a VM involved or not. A browser can load remote payload (not unde

it is not the same security context between web/browser apps and desktop apps wether there is a VM involved or not. A browser can load remote payload (not under user control) that can then exploit browsers flaw, Flash AVM2 flaw, etc. On the desktop the user run a local exe/app which has de facto "full system access". A bit surprised you don't know that, it's kind of basic ...