(Disclosure: I am not in any way a security researcher) > I am almost willing to bet $$$ that they would be fine if they had JS disabled I would guess that's

(Disclosure: I am not in any way a security researcher) > I am almost willing to bet $$$ that they would be fine if they had JS disabled I would guess that's because you do and that's what you use as a proxy to feel safe about the unsafe web. All of us even slightly aware of the security problems of browsing the web have something (for myself I immediately thought, I should add those domain names to my PiHole, just to be safe), but that's the problem with asymmetry: it costs you a lot to defend against everything; it costs a determined attacker very little in a marginal cost sense to spread their efforts across threat vectors. You're pretty sure disabling JS makes things safe. Do you allow CSS? That's another vector. What about all those cool new HTML5 apis we have now? Heck, it's tough to get developers to think at all about accessibility, what are the odds the developers who have to support that under-appreciated field put in a ton of extra time to make sure the features are fuzz tested? Anyone tested what you can do with the subtitle track to an HTML5 video player? I bought a copy of The Tangled Web a decade ago and never finished it because the whole thing was just too depressing to really come to grips with and instead I too have uBlock, a PiHole, some other Chrome extensions and a Mac as a sort of double-condom to make me feel safe without making me much safer. We are all the US military, happily stockpiling the wrong assets to fight the last war.