Well the zoom vulnerability from last year was a failure to consider full consequences of javascript. They thought binding a web server to localhost and having

Well the zoom vulnerability from last year was a failure to consider full consequences of javascript. They thought binding a web server to localhost and having a browser make requests to it was OK. They did not consider that literally any other web page can make the same requests.