[marginalia_nu]

Most black hat spammers use botnets, especially against bigger targets which have enough traffic to build statistics to fingerprint clients and map out bad ASNs and so on, and most botnets are low powered. You're not running chrome on a smart fridge or an enterprise router.

[desdenova]

Chrome is probably the worst browser possible to run for these things, so it's not the basis for comparison.

We have many smaller browsers, that run javascript, that work on low powered devices as well.

Starting from webkit and stripping down the rendering parts just to execute JavaScript and process the DOM, the RAM usage would be significantly lower.

[gnfargbl]

True, but the bad actor's code doesn't typically run directly on the infected device. Typically the infected router or camera is just acting as a proxy.

[mike_hearn]

There are ways to detect that and it will still require a lot of CPU and ram behind the proxies.