you got it wrong all the way
Just gentle reminder: web browsers were meant to display remote text, not run remote programs.
As long as we're forgetting this simple fact, there's no end of abuse by random crooks and corporate leeches: code misuse, lock-ins, standards degradation...