If websites can run JavaScript on your hardware, is that not sandboxed?