Comment by bawolff

> JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files"

this is besides the point, but javascript has the file system api.

anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.