&gt; 
Your comment doesn&#x27;t make sense. You&#x27;ve always been able to embed the renderer with non-JIT JavaScript.<p>Apple&#x27;s renderer. Not your own custom one.<p>&gt; The attack vector they&#x27;re concerned about is to do with the JIT exposing access to shared memory.<p>I don&#x27;t know what &quot;exposing access to shared memory&quot; means. All applications that download data place potentially-hostile data into memory.<p>&gt; As for alternate engines, any such engine would need to include a JavaScript engine, which immediately opens up vectors for attack.<p>Such as? Describe a specific attack that is prevented by forbidding interpreters of remote content.<p>&gt; That&#x27;s why the ability to download and execute code is restricted.<p>Downloading and interpreting code is something that even a PDF viewer does. Why is that not restricted?<p>&gt; now, thanks to a robust and secure cross process communications framework, many restrictions that were supposedly &#x27;for business reasons&#x27; have been lifted.<p>But not the restriction on alternate Web engines.