@brooke I mean, the problem with the browser sandbox is that everything is in the browser sandbox. If your location, contacts, email, GPU, and notifications are all in the sandbox, pwning it *is* the crown jewels already. JS and WASM put those things inside the sandbox.