JS has been able to escape the sandbox as long as browsers had JS support.

The stream of vulnerability discoveries has been constant.