&quot;and again Flash is the scapegoat&quot;<p>Truth hurts?  Adobe Flash and Microsoft Silverlight are common exploit paths because they have new critical exploits every few days.  Here&#x27;s the CVE list for Flash -- notice how many critical exploits there are? It averages to about 1 every 3 days.
<a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-53&#x2F;product_id-6761&#x2F;Adobe-Flash-Player.html" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-53&#x2F;p...</a><p>In contrast, JavaScript itself has been pretty stable for years. I think the last vulnerability related to JavaScript ES5 impacted old Firefox browsers.
<a href="http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2015-4516&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2015-4516&#x2F;</a>
<a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-452&#x2F;product_id-3264&#x2F;cvssscoremin-7&#x2F;cvssscoremax-7.99&#x2F;Mozilla-Firefox.html" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-452&#x2F;...</a> (Two JavaScript exploits for Firefox in 2015, both low risk.)<p>And HTML5? Extremely stable. There may be specific plugins or specific browsers that are vulnerable, but the underlying HTML5 specifications are very safe and have been safe for years.
<a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;google-search-results.php?q=html5&amp;sa=Search" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;google-search-results.php?q=html5...</a><p>If you know otherwise, then please cite the specific CVEs. Otherwise, you&#x27;re just spreading false information. You wrote, &quot;Browsers and HTML5&#x2F;JS also have a hell lot of CVE that can be exploited&quot;.  I say: Prove it. Cite your sources.<p>Edit: Adding links to Firefox exploit CVEs.