Earlier quoted context omitted.
You're running Javascript. It's sandboxed, which is why I have it enabled by default, but often the javascript in a website is made to spy on you and your behaviour. It's not on your side but on the side of the people who made the website. Personally I'm ok when something like discord breaks as it contains real time updates. But twitter just displays a bunch of text and pictues in a non real time manner. Even video c…
That's not arbitrary code in the security sense though. It's the very narrow range of things which are permitted to run in a javascript sandbox (more or less "things javascript can do in a web browser context, minus the extremely small chance someone is trying to drop a JS 0day on you using this link")
Yes it is. It's not system level, but it is indeed arbitrary code - users have no lasting visibility into what it's doing, and little ability to control it.
> It's the very narrow range of things which are permitted to run in a javascript sandbox
Browsers have had a pretty naive threat model, up until recent Firefox with its new resist fingerprinting feature. Seemingly innocuous things like reporting your window size are vulnerabilities that are being used to track you, because the groups who designed the various web APIs had no security mindset besides sandboxing. One of the chief browser makers is even an unabashed surveillance company! It's going to take a long time to close or mitigate all those holes.