Comment by immibis

Yes, it does. An MITM attacker can deliver malicious code to you which runs in the website context, and can exploit any bugs in your browser's javascript engine.