As mentioned in the article, I'm bad at reverse engineering. I merely point out the massive attack surface, and I'm pretty certain that this can be misused into

As mentioned in the article, I'm bad at reverse engineering. I merely point out the massive attack surface, and I'm pretty certain that this can be misused into infecting users with malware. But that's up to other people to prove, I'm not going to sink more time into this that nobody is going to pay for. How it should have been done: stay in the JavaScript sandbox for all the logic, rely on the browser's existing functionality, use an absolutely minimal communication interface to the application.