@Suiseiseki @MostlyHarmless It's been a few years since the last (known) instances in Firefox not dependent on Javascript, but CVEs for transport, image renderers & such are present for 2014, 2015 and 2016 that could've been turned into code execution (or demonstrably were).

It's way more common with Javascript and it's the majority of what is being found now. Though whether that's because people stopped looking elsewhere or the codebases truly improved, I couldn't say.