Comment by flukus

Who'd have thought running arbitrary code from random websites was a bad idea?

Blocking all scripts (at least by default) is the only solution.