@iank NoScript and LibreJS are extensions, so they have only a limited ability to block JavaScript and crafted attacks have been found in the past that cause a bypass of the blocks and execution of JavaScript (there is many places to hide JavaScript in and the only reliable way to have it not be executed is to configure the JavaScript engine to not execute anything but extensions).