Most of the vulnerabilities I've seen that could infect your machine from a website require JS to work and most of those had nothing to do with the engine itsel

Most of the vulnerabilities I've seen that could infect your machine from a website require JS to work and most of those had nothing to do with the engine itself. Sandbox escapes are extremely common. Chrome patched one that'd been being actively exploited just last week