[arepublicadoceu]

> Even on a single user system which doesn't run untrusted software?

If you use the web you run untrusted code all the time, unless you block js and never turn it on.

Unless you verify each code, on each software you run and build it yourself or have reproducible builds, then you run untrusted software.

I would only be comfortable disabling these mitigations if the computer were air-gaped and never touched the internet.

So yeah, it' unwise to disable these mitigations, but, in the end, it's your call.

[Tagbert]

does JavaScript really have the level of access to abuse these kinds of vulnerabilities?