People cite the browser a lot and I think it is the most important case because it runs untrusted javascript. So an exploitable browser bug maybe shouldn't have

People cite the browser a lot and I think it is the most important case because it runs untrusted javascript. So an exploitable browser bug maybe shouldn't have all these permissions without asking. OTOH the browser should apply such mitigations voluntarily.