> running untrusted code in a sandbox is still running untrusted code on your machine asm.js and various obfuscators allow websites to do this in the first pla

> running untrusted code in a sandbox is still running untrusted code on your machine asm.js and various obfuscators allow websites to do this in the first place with closed-source code, with a far larger attack service than the EME sandbox. In not a lot of time from now, they quite reasonably could.