Even if it's far from obvious to an average person that JavaScript is a pwn vector, I think you're more correct than not. You need enough isolation to run untru

Even if it's far from obvious to an average person that JavaScript is a pwn vector, I think you're more correct than not. You need enough isolation to run untrusted code. If JS code can still exploit CPU bugs, then clearly more isolation is needed one way or another.