Your comment doesn&#x27;t make sense. You&#x27;ve always been able to embed the renderer with non-JIT JavaScript. Now you can build an app with full JIT embedded, so saying they don&#x27;t want you to for business reasons is obviously false. They do let you do it.<p>The attack vector they&#x27;re concerned about is to do with the JIT exposing access to shared memory. As for alternate engines, any such engine would need to include a JavaScript engine, which immediately opens up vectors for attack. That&#x27;s why the ability to download and execute code is restricted. now, thanks to a robust and secure cross process communications framework, many restrictions that were supposedly &#x27;for business reasons&#x27; have been lifted.