The core RNGs of the three main JS engines are I believe at this point all Xorshift variants (same core structure, slightly different code interfaces). They al

The core RNGs of the three main JS engines are I believe at this point all Xorshift variants (same core structure, slightly different code interfaces). They also seed (or should seed, I know JSC does) per-global object from a CSRNG. If you have an application that really does need secure random the Dom specifies crypto.getRandomValues, which is specified as requiring a cryptographically secure implementation.