Every visited HTTP website is a network vulnerability. It doesn't matter what is supposed to be on these sites. From security perspective they contain MITM att

Every visited HTTP website is a network vulnerability. It doesn't matter what is supposed to be on these sites. From security perspective they contain MITM attacker's content. They are effectively an API for issuing arbitrary commands to the browser. To shut down this attack API, all sites have to stop using HTTP, no exceptions.