> I've been coding JavaScript for many, many years. I've never encountered a situation where the lack of typing bit me in the ass. Not even once! Okay, well, h

> I've been coding JavaScript for many, many years. I've never encountered a situation where the lack of typing bit me in the ass. Not even once! Okay, well, here's an example of it leading to a CVE: https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/ https://www.mozilla.org/en-US/security/advisories/mfsa2012-7... The way-and-how of it is that the then-new devtools team working on the then-new JS console lost track of what objects they were passing into a polymorphic function, which resulted in untrusted, content-supplied objects being treated the same as DOM nodes that were supposed to originate from within the JS console implementation itself (for its UI), which resulted in browser-level privileges being given to content authors of ordinary web pages.