JavaScript is an RCE vulnerability. Browsers literally execute it as "run this malicious code in a vm, then nuke the whole thing from the orbit".