Web pages can't do anything that affects the rest of your system without going through a permission dialog, and the permissions are always very granular. A page

Web pages can't do anything that affects the rest of your system without going through a permission dialog, and the permissions are always very granular. A page can't trigger a yes/no permission dialog to get access to all of your files; it can only trigger a file-picker that gives it access to whatever the user picks in it. An .exe doesn't need to go through any permission dialog to upload/wipe/infect any file in your home directory.