If there is no vulnerability in the javascript engine or any of the API they exposed to it in order to mockup a web browser then it can't do anything. The probl

If there is no vulnerability in the javascript engine or any of the API they exposed to it in order to mockup a web browser then it can't do anything. The problem here is that that's not exactly a tiny attack surface, and modern web browsers implement defense in depth and sandboxing untrusted code for very good reasons. If there was some RCE for a part of this javascript engine, you're not just executing inside of some locked down environment, you're not just executing code as an untrusted user, you're executing code in a process with SYSTEM level permissions. This is like putting a 2 meter wide thermal exhaust port on your death star. On the off chance someone manages to hit it, game over. This process runs untrusted code so if you can get a file opened on the target computer, or even just get the user to go to a malicious website, you can try to attack this. Once you get some payload running yeah you could use bog standard crimeware to sniff out any credit card details entered, export your saved passwords from your web browser, look for any wallet.dat equivalents and run a keylogger waiting for you to decrypt it, drop some ransomware on the system, etc. This gives full control over the system if you find an exploit to it. But yeah, this isn't immediately a vulnerability, just a poor design decision and a very juicy target.