Comment by MisterMunchkin

you can disable extensions and run noscript. that should take care of most attack vectors that people roll. there are some CVE which dont use it but those are more rare and usually quite 'expensive' as they require an actual exploit rather than just some code.

> we really need browser developers to shut this shit down. Why are you even able to silently run all of these commands on my computer

???

This is a very strange understanding of the purpose of a browser you've installed on your computer does. It requests resources from other places and displays & runs those resources on your computer. Where else would they run? Or are you saying you don't actually want your browser to do what you've instructed it to do ("navigate to example.com and run it").

Or you only want to run certain pieces of what's delivered? (You have the power, and should exercise it, to do so, with ad blockers, script blockers, etc.)

The problem is that big companies with lots of money demand the situation continue so that they can make more money.

Because these capabilities are dual-use.

You want canvas to work for web games and design / drawing sites. Yet. minuscule differences in how canvas is implemented let other sites fingerprint you. The only way to fix this would be to have each browser be based on the exact same codebase and web engine, and do you really want that?