Is it still possible to run malware in a browser using JavaS