No, according to the spec, I can enable / disable JS and not run any code, which I'm doing: https://html.spec.whatwg.org/#enabling-and-disabling-scripting https

No, according to the spec, I can enable / disable JS and not run any code, which I'm doing: https://html.spec.whatwg.org/#enabling-and-disabling-scripting https://html.spec.whatwg.org/#enabling-and-disabling-scripti... So an HTML document viewed in a browser with JS off should not itself run code, ever.