If you can load a font on the client, the loading can fail. If the load can fail you can catch the error. If you can catch the error you can store a list of fon

If you can load a font on the client, the loading can fail. If the load can fail you can catch the error. If you can catch the error you can store a list of fonts without being able to actually do an enumerate request. And it wouldn't be much of a browser if it couldn't POST data to an html endpoint. As soon as you introduce a programming environment you introduce the ability to do all sorts of things that aren't builtin. It's generally not the browser saying, here's the list of my settings, you asked for, but rather a program being executed that pokes around at all the things it can interact with to squeeze out info. But I agree, that javascript should not have access to audio device models numbers with or without permission, nor should it have any kind of access to the browsers chrome.