[wmf]

what exactly is the attack vector for getting a "foothold into your javascript execution"?

Browser extensions? Those have been stealing BTC for a while.