Remote-code-execution as a feature just isn't a good idea. Sandboxes can (and Murphy's Law says they will) be broken out of. There are many documented browser-

Remote-code-execution as a feature just isn't a good idea. Sandboxes can (and Murphy's Law says they will) be broken out of. There are many documented browser-exploits and basically all newer ones that are actually a danger to users involve Javascript. It's also not reasonable to assume that people only visit trusted sites.