You have to specify a whole lot more context if you talk about executing code "locally" vs. executing "from a web page". JavaScript usually gets JIT'ed into ma

You have to specify a whole lot more context if you talk about executing code "locally" vs. executing "from a web page". JavaScript usually gets JIT'ed into machine language code. That code gets executed locally. There are usually a bunch of differences in terms of form and restrictions around that code, but this might well be a case where most of those differences don't matter. Or in other words, browsers are just compilers/interpreters like any other, albeit very hardened ones because of the large exposure of untrustworthy code they are subject to. But if an attack fundamentally skirts around sandboxes, the browser sandbox won't help. It's Turing machines all the way down.