Wow. I wonder how many vulns like this are unknown outside of identity broker co's and gov intel orgs. Seems like new ones discovered hella lot.

Turning the WWW into an app platform was a mistake. JS allows so much fuckery.

Yeah the main strat is to completely disallow javascript. Makes the web so much better unironically.

That's my exp too. Esp with the endless pop-overs like "We share your data with our 5 million partners! Unless you dig through 45 pages of opt out checkmarks, b/c fuck you". 95% of the time, disallow JS bypasses those.

Also tho, some important sites flat don't work with js disabled. I hate that. I get it. There are some things where js is necessary. But it's like 2% good things plus 98% fuckery.

Yeah for those sites I just enable the bare minimum on Noscript.
It is good tech support for family to set them up with a simple button to enable a disabled by default Javascript browser. Like Brave or Helium.
Keeps them from going to random websites that are malicious.