https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/
-> https://www.fsfla.org/~lxoliva/#specmelt
running programs downloaded from untrusted sources is risky
block JavaScript!