[dzaima]

Browser sandbox escape to userspace exploits are still much harder to make though, compared to... uh.. a userspace to userspace exploit, given that the latter takes literally (actually literally) zero effort, and as such you don't have one every couple weeks, but rather an ∞ of new exploits per second.

(that said, a web-based client has the aspect that an exploit could be inserted at any point with only a page restart necessary, whereas a native client would need updating; but hopefully you update your client, lest you start missing out on new protocol features!)