> and not visiting untrustworthy pages with JS on Assuming your browser is up-to-date and there isn't a 0-day being exploited, can a malicious website even do

> and not visiting untrustworthy pages with JS on Assuming your browser is up-to-date and there isn't a 0-day being exploited, can a malicious website even do anything?