JavaScript is the main way of delivering attacks because it's the main way of ge...

lmm on Dec 3, 2023 | parent | context | favorite | on: You don't need JavaScript for that

JavaScript is the main way of delivering attacks because it's the main way of getting a browser to do anything. Actual vulnerabilities tend to be anywhere (image decoding in particular) and you can trigger them from anything, it's just easier to trigger them from JavaScript rather than some absurd spaghetti CSS.

fsflover on Dec 3, 2023 [–]

As the OP says, many things can be done without it.